Your team struggles with password security awareness. How can you get them to prioritize strong passwords?

As far as awareness is concerned, it can be only increased via communication. Communicating the organization's goals, ethics or strong industry standards or practices can only raise the required awareness. It's the lack of communication between organizations goals and vision and employees, which dulls the need of having a strong password. With effective communication through email, training or workshops this awareness for prioritizing strong password can be generated.

Password strength should be a part of annual security awareness training along with regular reminders throughout the year. The training should provide specific examples and address the benefits of leveraging a strong password, as well as the need to meet contractual and regulatory compliance requirements.

These days Annual Security training is more of a compliance requirement. While it is necessary to do so, we must focus on more creative and engaging contents to raise awareness. Create Short Videos, Stories, Scary Stories, Incentive and rewards,etc to raise awareness.

Training sessions are critical in ensuring end-users understand how to generate complex and secure passwords. During training, emphasize the importance of password requirements such as length, case, alpha and numeric, and special symbols. The training also needs to cover any tools used for password generation and management, such as one login, dashlane, etc.

Conduct regular and interactive training sessions on password security. To make the session understanding, use real-world examples to illustrate the risks of weak passwords. Ensure the sessions cover the importance of unique and complex passwords, and how to create and manage them effectively. Incorporate some sessions, like hands-on activities where employees create and test their passwords against strength meters. As well as provide insights and share case studies on the impact of password breaches.

Should we not be moving away from passwords and to passkeys? The platforms are there. The value is high. And they are simple. Phrases must be carefully considered but of course are still vulnerable to theft or eavesdropping / key logging. Our next layer is MFA but there are a lot of bypasses to this. Thus we need to layer it with logic and other (basic) considerations and perhaps consider multiple layers of authentication in case of season theft. Vaults are themselves a risk but they are better than the alternatives. Make sure these are carefully protected with multi factor. Have a recovery option in place and where possible implement enterprise management together with surveillance.

Selecting a password generator and management tool is paramount to ensure your end-users will follow policies and procedures. Make sure to select a tool from a vendor with a good reputation in the industry and really focus on ease of use. The goal is to make the end-users job easier while increasing the overall security posture.

Encourage on SSO as much as possible. MFA should be mandated. In case password management tools are used, the Vault, where passwords are stored must be protected.

Having users create strong passwords is a complete waste of time. They will just write it down or store it in a file on their PC or phone. Static passwords are a remnant of a time gone by. Anyone still using static passwords must understand the risk. If you must use a password then you should use a phrase you can remember like "The Lord is My Sheppard I shall not want". The password would be 1Tlims15halln0tw@nt!

In this case, Implement the use of password management tools to generate, store, and manage strong passwords. Ensure these tools are user-friendly and integrate seamlessly with the systems in use. Moreover, recommend industry tested specific tools which offer strong encryption and cross-device synchronization. Most importantly, provide training on how to use these tools effectively and ensure they are part of the onboarding process for better results.

Leverage technical controls to ensure users are forced to create password in alignment with policies and procedures. Disable browser password saving and ensure that only the authorized password management tool is being used. Conduct regular dark web scans to ensure there aren’t any breached/stolen credentials currently out in the wild.

Establish clear policies on password creation, use, and expiration. Verify the policies require passwords to be long, complex, and unique for different accounts. Regularly review and update these policies. Besides, enforce multi-factor authentication (MFA) to add an extra layer of security. Use automated systems to enforce policy compliance, such as requiring password changes every 90 days and preventing the reuse of old passwords.

Get the executive and management teams support to drive awareness. Follow password configuration standards that is align with your industry.

Provide both intrinsic and extrinsic motivations for end users that comply with policies. This can include shoutouts on the company intranet or news letter, prizes, gamification, etc.

Everyone plays a role in maintaining strong password security. Enable MFA wherever possible. It adds an extra layer of security by requiring a second form of verification

SSO and MFA should be the focus. Create a validation of most guessable and hackable password. Avoid repetition of passwords. Encourage Staff to come up with ideas.

Managing passwords securely is crucial in protecting your online accounts and sensitive information. Here are a few straightforward steps to achieve this: 1. Maintain open communication channels so team members can report any suspicions or incidents related to password security. 2. Implement a password manager. These tools can generate and store strong passwords, making it easy for your team to use unique passwords for various accounts without having to remember them all. 3. Conduct regular training sessions and workshops on cybersecurity. Make them engaging and interactive to keep your team interested and informed.

To improve password security, start by educating your team about the risks of weak passwords, like data breaches, using real-life examples or simulations. Conduct regular training sessions to teach how to create strong passwords using different characters and avoiding common patterns. Show the benefits of password management tools for creating and storing passwords securely. Eg : LastPass, 1Password,Keeper Implement a strict password policy that outlines password complexity, change intervals, and proper storage. Regularly check if everyone is following the policy. Reward team members who follow these rules with small incentives, which helps build a strong security culture. Encourage ongoing feedback to keep improving password practices.

We are moving in a new era of passwordless and I believe we need an article to focus more on how to go passwordless and remove password rather than discuss on the password itself.