How to create a stronger security policy in 9 steps

By Jordan True

Here’s the bad news, your end users are lazy. You’ve seen it all… sticky notes on computer screens, computers left unlocked while people are out grabbing coffee, and simply not following your corporate security policies at all. Take a look at the latest data form SplashData announcing the 2015 edition of its annual “Worst Passwords List”. The two top ranked passwords are — YET AGAIN — “123456” and “password”. How many of YOUR colleagues and end users use these passwords every day to protect your corporate data?

People are hard to teach and hard to retrain out of shortcut habits. Let us help you educate. These are the 9 steps to start your year off right with password security company-wide. And, we put them together in an easy to remember acronym: GET STRONG.

1. Go with encryption: Passwords cannot be left in plain text ever and especially not in an Excel document. Always store passwords with encryption.

2. Escape complexity: Focus on teaching your end users to use longer and more easily remembered passwords, like password phrases. Don’t let them get bogged down with having to remember special character requirements.

3. Teach employees: Continued training is critical and is the most important step to your policy being implemented. Make sure your users understand their role, prepare quarterly reviews, and make it fun with incentives.

4. Size matters: The longer the password the harder for the hacker to break. It’s simple, make human passwords at least 8 characters long and systems passwords 12-50 characters.

5. Trust no one: 2-factor is a must! No matter the size of your organization, there are a two-factor options like RADIUS tokens, DUO, or Google Authenticator.

6. Rotate often: Don’t let those human passwords go unchanged for more than 90-180 days. And for system passwords, they need to be changed every 30-90 days. Setting a reminder is essential to ensure they are rotated timely.

7. Omit duplicates: Use a unique password for each of your accounts. The same password should never be used more than once!

8. No cheating: Remembering a long password can be difficult, but don’t allow password hints. These just make it easier for hackers to get in.

9. Get a vault: Start using a trusted password manager to enforce strong password best practices. This way, users can always generate long and complex passwords, never have to remember all their passwords, and if you use a vault for your IT team, you can find one that automatically changes your admin passwords. When it comes to IT, automation is key to preventing a breach!

You know password security is important — Now it’s time to test to see how you score!

The new Web Password Finder meets these key challenges and helps showcase to management the success of your Security Policy Program:

How can you know if your employees are using strong passwords?

The Weak Password Finder tool for Active Directory accounts can help ensure your organization has a strong password practice in place!

How can you tell if your Cybersecurity Awareness training is working?

With our Weak Password Finder tool, you can run the tool today to establish a baseline of your existing security policies. Then, after each of your security training sessions, you can rerun the tool to see if your security training has been effective – providing you with measurable results of your program!

Does forcing your users to update their password every 30 days help or hurt?

Just like measuring your security awareness program, you can also measure how effective forced password rotation is on your network. Run this tool every 30 days, record the results, and compare the reports every month to see if there is measurable improvement in the security of your policies!

Feel confident that your corporate Security Policy is strong. Get started with the Weak Password Finder today.

Source:: Thycotic