Your team is pushing back on strict password policies. How can you ensure company systems stay secure?

Conducting periodic security awareness training for the team is very essential to raise awareness on the importance of information security. Using use cases with historic security incidents illustration is a great approach to make it relatable on the need to implement the security policies to protect their personal data and the company data

Training is essential for users to understand the importance of security. One way to make it more effective is to bring up real cases of hacking, including examples of business owners and friends who have seen their situation compromised by these cases.

SER GOVERNANTE DE EMPRESAS EU ACHEI MUITO FACIO, PORI?O ESTOU AQUI VIVINHO DA SILVA PRA CONTA A MINHA ISTORIA, MAS PELO MEOS LUTEI DENTRO E FORA DO SISTEMA FINANCEIRO LUTEI COM UNHAS E DENTES PRA POR EM VIGORA MINHAS LEIS,

L'élément prilordiale doit être la sensibilisation sur les risques de sécurité quand les mots de passe ne sont pas renouvelés régulièrement. Ensuite la formation. Il est aussi important de mettre en place au sein de l'organisation une charte de bonne conduite. Qui encourage et félicite les bons collaborateurs et des avaertissement et sanctions si possible pour ceux ne respectant pas la charte.

I differ from the method of password management because tools transfer the responsibility from the user to a "robotized" method that, if hacked, the user will be vulnerable.

Effective but simple methods should be used, a 10-character password that mixes letters, numbers and special characters is effective as long as they maintain a logical sense of assignment and are not converted into sequences between one period and another... 01, 02, etc.

By introducing simple, user-friendly MFA options to users, your company could stay secure while requiring less training and effort from all parties. MFA is like going outside knowing you have turned off your microwave without knowing that you have turned off your microvawe!

Compliance monitoring is essential to ensure that users respect the rules. If we do not verify that the policies we implement are being followed, any feedback or improvement we wish to make is meaningless.

We need to know if the methods we have established are really effective and functional for users and the organization, and if they do not fulfill the function they were established for, we need to adjust them. If something as simple as controlling password changes becomes cumbersome, then we will be faced with more complex situations that we will ignore, for example, backup control.

For password policies: simply placing password complexity and duration requirements is insufficient and, if done excessively, can work to rationalize shadow IT in others. There are always people smarter than you and/or your systems. Remember that "security culture" is what happens when IT isn't looking. MyBambiRiver15pswd probably infers MyBambiRiver16pswd. Don't rotate passwords so often that users sacrifice entropy for memorability. Tokens such as yubikeys are powerful(use them), but they are almost always half-configured because they can be unique for each integration. MFA is also overlooked in a couple public facing locations. It absolutely must be on 100% of public facing logins and we should strive for 100% internally as well.

Biometric procedures should be used; these are established on all smartphones and users are familiar with them. Forgotten or cracked passwords etc. will then also be a thing of the past. Anyone who still has to log in with long passwords today is living in a false sense of security. MFA certainly leads to increased security, but anyone who has to log in several times a day will certainly not be enthusiastic about having to wait for an e-mail, text message or push notification every time. It is therefore important to take a closer look at the different users and the security aspects of the end device in order to achieve an acceptable balance between security and ergonomics, as well as user acceptance.