Passwords: You Hide It Well

Every CSO dreams of the perfect password. One that is uncrackable, yet easy for users to remember. Although password perfection is still the stuff of fantasy, there is a formula you can use to create passwords that are both hard to decode and easy on the memory. All you have to do is encourage your employees to get creative.

When it comes to password integrity, the key is to obfuscate words as much as possible, says Samir Kapuria, director of strategic solutions at digital security consultancy @Stake. Mix the words up as much as possible by using both upper- and lowercase letters, numbers, symbols and punctuation. There’s no ideal combination of letters, numbers or symbols, Kapuria says, but try to make passwords six to eight characters long. The goal is to make each password as difficult for hackers to decipher as possible. For example, you can use 0 in place of an O, @ in place of an A, or 3 in place of an E. Each layer of difficulty that you add to the password will increase the time it takes for a hacker to crack it. It can take hackers up to 30 days to decrypt some passwords. If you require employees to change their passwords once a month, you have a good shot at staying just ahead of the game.

Kapuria warns that CSOs should guide employees away from the dictionary to select passwords. Hackers know that users tend to choose intuitive passwords based on whole words that can be found in a dictionary, and so they’ve developed sophisticated tools to decrypt dictionary-based words quickly. But fear notyou don’t have to resort to foreign languages or gibberish to keep your passwords intact. Just avoid using any word that looks like it makes sense, Kapuria says. Instead of using a movie title as your password, for instance, use the first letter of each word in the title. To make the password six to eight characters long, insert dollar signs or other symbols instead of putting a space between letters. While it may not be 100 percent hack-proof, it won’t make sense to anyone but the end user. The employee stands a good chance at remembering her password, but it will take a hacker days to figure out. And a few days head start on a hacker never hurt anybody.