However, after surveying 1,832 business owners, they found that:

• 39% don’t offer proper personnel password training
• 61% don’t require password complexity to improve strength
• 44% don’t have adequate understanding of brute-force attacks
• 35% don’t deactivate unused employee profiles
• Only 26% include strong multi-factor authentication methods!

Here are Specops Software’s top five tips on how businesses can improve password security in their organization:

1. Proper personnel training

No matter what innovative protection algorithms are used in your company, if your staff keep passwords in a text doc on the desktop, or even worse on a sheet of paper, all other security measures are likely to fail. That’s why it’s critical to invest in cybersecurity training to teach your personnel the basics of information protection, including proper password management tools where they would have to remember just one passphrase and the software would do the rest – that way passwords would be protected.

2. Password strength requirement

Apart from the widely used complexity requirements (minimum number of characters, upper- and lower-case letters, as well as special symbols and numbers), it’s necessary to consider more complex password policies within Active Directory (AD). These include maximum password age to force users to regularly change their passwords, ensuring proper data encryption so even in a case of a breach the data remains safe, and storing the password history to avoid the reuse of previous passwords. 

3. Brute-force protection

Brute-force attacks aim at guessing passwords by trying different popular combinations as well as dictionary attacks (searching correct combination by existing dictionary words). Despite the best security practices, people still opt for simpler passwords that increase chances for successful breaches. The best way to avoid it is automatic lockdown for logins after several failed attempts as well as the IP address block if the failed attempts continue. It can be done in AD as well as in different corporate resources.

4. Profile deactivation during employee attrition

According to a recent study on password usage, 50% of accounts in a company are stale, which increases the risks of unauthorized use of corporate resources. Even if the departure was mutually agreed, it’s better to be safe than sorry and change all shared passwords right away after their last working day. The ideal variant would be to avoid using shared passwords as much as possible. Still, there are some cases when it’s not possible. The same goes for immediate deactivation of the user’s profile. This practice would help to protect from sensitive data exposure as well as minimize the usage of your resources in someone’s personal interest (selling data for competitors or blackmailing the company).

5. Additional protection layers

Unfortunately, passwords today cannot be fully replaced by alternative authentication methods such as 2FA, where users would have to confirm their login via codes sent to their emails or phones, or using an even more secure way such as one-time passwords (OTO). Including these methods where possible significantly reduces the risk of a successful login even when a password leakage occurs.

While complex security measures include other steps such as VPN protection for internal resources, trusted firewalls, and anti-malware software, passwords management plays a significant role in system protection. Using these tips in everyday administration management will help to limit the number of successful breaches connected to weak passwords, thus increasing the integrity of the overall IT estate.