A password is often all that stands between you and sensitive data. It’s also often all that stands between a cybercriminal and your account. Below are tips to help you create stronger passwords, manage them more easily, and take one further step to protect against account theft.
- Always: Use a unique password for each account so one compromised password does not put all of your accounts at risk of takeover.
- Good: While SRSU only requires passwords of 8 characters or more, a good password is 10 or more characters in length (an odd number of characters is even better), with a combination of uppercase and lowercase letters, plus numbers and/or symbols — such as pAMPh$3let (Don’t use this for your password). Complex passwords can be challenging to remember for even one site, let alone using multiple passwords for multiple sites; strong passwords are also difficult to type on a smartphone keyboard (for an easy password management option, see “best” below).
- Better: A passphrase uses a combination of words to achieve a length of 20 or more characters. That additional length makes its exponentially harder for hackers to crack, yet a passphrase is easier for you to remember and more natural to type. To create a passphrase, generate four or more random words from a dictionary, mix in uppercase letters, and add a number or symbol to make it even stronger — such as rubbishconsiderGREENSwim$3. You’ll still find it challenging to remember multiple passphrases, though, so read on.
- Best: The strongest passwords are created by password managers — software that generates and keeps track of complex and unique passwords for all of your accounts. All you need to remember is one complex password or passphrase to access your password manager. With a password manager, you can look up passwords when you need them, copy and paste from the vault, or use functionality within the software to log you in automatically. Best practice is to add two-step verification to your password manager account. Keep reading!
- Step it up! When you use two-step verification (a.k.a., two-factor authentication or login approval), a stolen password doesn’t result in a stolen account. Anytime your account is logged into from a new device, you receive an authorization check on your smartphone or other registered device. Without that second piece, a password thief can’t get into your account. It’s the single best way to protect your account from cybercriminals.
We all need help from time to time, remembering passwords for all the accounts we use. #SRSUOIT recommends Lastpass to help you manage and remember all your passwords.
Follow us on Twitter @SRSUOIT
Like us on Facebook SRSUOIT
This article courtesy of Educause with some edits by SRSU staff
According to the US Department of Justice, more than 17 million Americans were victims of identity theft in 2014. EDUCAUSE research shows that 21 percent of respondents to the annual ECAR student study have had an online account hacked, and 14 percent have had a computer, tablet, or smartphone stolen. Online fraud is an ongoing risk. The following tips can help you prevent identity theft.
- Read your credit card, bank, and pay statements carefully each month. Look for unusual or unexpected transactions. Remember also to review recurring bill charges and other important personal account information.
- Review your health insurance plan statements and claims. Look for unusual or unexpected transactions.
- Shred it! Shred any documents with personal, financial, or medical information before you throw them away.
- Take advantage of free annual credit reports. In the US, the three major credit reporting agencies provide a free credit report once a year upon request.
- If a request for your personal info doesn’t feel right, do not feel obligated to respond! Legitimate companies won’t ask for personal information such as your social security number, password, or account number in a pop-up ad, e-mail, text, or unsolicited phone call.
- Limit the personal information you share on social media. Also, check your privacy settings every time you update an application or operating system (or at least every few months).
- Put a password on it. Protect your online accounts and mobile devices with strong, unique passwords or passphrases.
- Limit use of public Wi-Fi. Be careful when using free Wi-Fi, which may not be secure. Consider waiting to access online banking information or other sensitive accounts until you are at home.
- Secure your devices. Encrypt your hard drive, use a VPN, and ensure that your systems, apps, antivirus software, and plug-ins are up-to-date.
If you become a victim of identity theft:
- File a report with the US Federal Trade Commission at IdentityTheft.gov.
- Use the identity theft report to file a police report. Make sure you keep a copy of both reports in a safe place.
- Flag your credit reports by contacting the fraud departments of any one of the three major credit bureaus: Equifax (800-525-6285), Experian (888-397-3742), or TransUnion (800-680-7289).
Follow us on Twitter @SRSUOIT
Like us on Facebook SRSUOIT
Article courtesy of Educause
You exist in digital form all over the Internet. It is thus important to ensure that the digital “You” matches what you are intending to share. It is also critical to guard your privacy — not only to avoid embarrassment, but also to protect your identity and finances!
Following are specific steps you can take to protect your online information, identity, and privacy.
- Use a unique password for each site. Hackers often use previously compromised information to access other sites. Choosing unique passwords keeps that risk to a minimum.
- Use a password manager. Using an encrypted password manager to store your passwords makes it easy to access and use a unique password for each site. See https://securingthehuman.sans.org/newsletters/ouch/issues/OUCH-201310_en.pdf for more info on password managers. The OIT department uses Lastpass for our purposes and have found it easy to use and secure.
- Know what you are sharing. Check the privacy settings on all of your social media accounts; some even include a wizard to walk you through the settings. Always be cautious about what you post publicly.
- Guard your date of birth and telephone number. These are key pieces of information used for verification, and you should not share them publicly. If an online service or site asks you to share this critical information, consider whether it is important enough to warrant it.
- Keep your work and personal presences separate. Your employer has the right to access your e-mail account, so you should use an outside service for private e-mails. This also helps you ensure uninterrupted access to your private e-mail and other services if you switch employers.
- There are no true secrets online. Use the postcard or billboard test: Would you be comfortable with everyone reading a message or post? If not, don’t share it.
(Taken in part from the EducauseReview website)