Strength essential for password security

  • Published
  • By Senior Airman Amanda Dick
  • 86th Airlift Wing Public Affairs
RAMSTEIN AIR BASE, Germany --  In the world of computer security, passwords are a must.

From sites such as Facebook and Twitter to government sites like the Advanced Distributed Learning Center and the Defense Personal Property Systems, passwords safeguard personal information.

"In today's cyber world, companies and corporations have made it much more convenient for us to access our bank accounts, training records, medical records and other sensitive information," said Staff Sgt. Julian Garcia, 86th Airlift Wing Information Assurance technician. "This has also made it easier for the bad guys to gain access to our personal information. Not protecting our passwords defeats the whole purpose of having them in the first place."

The basic idea behind a password is it's a key to unlock a virtual door to your computer, e-mail, bank account, etc. To help prevent others from hacking into personal sites or accessing information, users are encouraged to create strong passwords. But, what determines the strength of a password?

According to Microsoft's Online Safety website at http://www.microsoft.com/protect/default.aspx, "an ideal password is long and has letters, punctuation, symbols and numbers."

The website also suggests some of the letters be uppercase, to try to use at least 14 characters and to incorporate as much of the keyboard as possible.

"Setting complex passwords makes it that much more difficult for attackers to gain access to our networks, personal accounts and other sensitive and personal information," Sergeant Garcia said. "It's our responsibility to set complex passwords."

With so many passwords military members need to remember, one might be tempted to jot it all down. Sergeant Garcia said this is a bad idea.

"The best way to protect a password, or PIN, is to remember it, and never right it down," he said. "It may seem impossible these days with having to remember passwords and PINs for our network accounts, e-mail accounts, websites, bank accounts, school accounts, databases and online shopping carts. A good method is to rely on a series of words and use memory techniques or mnemonics to help you remember how to decode it. If passwords are written down, they are accessible to anybody who has physical access to where they are stored."

An example the IA technician gave was, instead of using something like "hoops," to come up with a phrase such as "(I) (l)ike (T)o (p)lay (B)asket(b)all," using upper/lowercase letters with a combination of numbers and special characters. So, the password would look something like "Il!2pBb."

"It's not necessarily the typical hacker or virus, but rather the malicious or careless insider who poses the biggest threat to our networks and information," the sergeant said.

For more information, contact your unit or wing Information Assurance office or visit the U.S. Computer Emergency Readiness Team website at http://www.us-cert.gov/cas/tips/ST04-002.html.