One of the overlooked area many of us struggle with is password management. In our day to day computing activities, many of us would simply just use or chose to protect our assets with a simple password. These assets could be critical such as bank accounts, confidential data, or even health information. We are lacking the real work on password management.

Now, just what is password management really is? Well, in its very simplest form, managing passwords!

In corporate world, there are various technologies that does password management. In fact, password management is covered in a good scope on many of books for the CISSP exam.

Now, before going deeper to it, let’s magnify our glass to the word password itself. Many, if not all of us know what password is. That’s the word you write on your sticky note and hide it underneath your keyboard. Kidding aside.

Password is the most widely and commonly used authentication mechanism. They are also considered the weakest security mechanism. Users would simply choose very easy passwords such as their date of birth, favorite color, their nickname, etc., that are easy enough to guess. Sometimes too, they give it away to their buddies or best friends.

It is funny yet interesting to see how users typically thinks security is not one of the most important part of their computer. Not until someone hacks into their computer or account, then that’s when security is all the frustrations.

So here comes password management to the rescue. Although the scope of this article will dive only deeper to day-to-day users of computers, emails and services; it will touch a bit on the corporate world where I will cover some of the best ways in managing password. Bear in mind, this article does not go deeper in how to implement SSO technologies or token devices and such.

Simply put, you got to protect your treasured belongings with your best security. You wouldn’t really want to put your jewelries, money, and other important belongings into a carton box just lying around your doorstep. The same would you need to protect your emails, your computers, your accounts with a good password.

A good password is at least eight characters and contains a combination of upper and lower case and special characters. Try to choose something not closely related to you, such as your color, pet name, or belongings. An example would be “1Fo126iveYoU” is a strong password. “blue123″, while it contains letters and numbers, it is still vulnerable to dictionary and brute-force attacks. I am not going to explain those but in short, those are types of attacks a hacker can use to guess your password. There are many free and easy to use programs out there that can easily do the guessing.

Also, not writing your password where someone can read or see is a good countermeasure to remember. Sometimes, we often change our password similar to previous one but incrementing or decrementing other characters. Such as “PassWord1″ is your previous and “PassWord2″ is your new. If you wrote it down in a piece of paper and throw it away, an attacker can go to the trash bin and try to find them. This technique is also called Dumpster Diving. So be aware, not because you are done with your password doesn’t mean they still cannot use it to guess your other passwords.

There are systems nowadays that will ask you for phrase instead of a password. These are called passphrase. So instead of entering “password 123″, you might be asked to key in “let me in this is me”. Also other systems do a different way by allowing you to enter cognitive password. Cognitive password are opinion- or fact-based information. These are usually derived by answering questions related about your life. The answers are then transposed to a virtual password.

In systems where we are only required to put our password, it is your duty to secure it. I’ve covered few ways to secure your password here but there are other many ways you can do on your own. Something I did not cover which is beyond the scope of this article is the implementation of encryption or token device to ensure that the password of user are not sniffed, eavesdropped, or captured by attacker for a replay-attack. These countermeasures are for security professionals to implement technical or logical controls in their enterprise.

The use of password synchronization, assisted password reset, and self-service password reset are few approaches you can implement in your enterprise to assist users reset their password and not being compromised during resets. Those are the real “password management” discussion.

As end users, protect your password as if it is the key to all your belongings. Remember, attackers can sniff them (so corporate should implement encryption), can brute-force guess them (apply hard-to-guess strong password), or they can steal them (using techniques such as dumpster diving, shoulder surfing, keyboard monitoring). Shoulder surfing is when someone is looking over your shoulder or back as you type in your password.

Next time, I will try to cover in details some of these attacks that you really need to be aware of.

PHISHING is a social engineering technique, which means to trick someone into believing something but different to what it really means, with a full purpose of obtaining personal information, credit card information and credentials.

The word phishing has been around since 1996. It was originally coined by hackers who started stealing AOL passwords by posing as a staff member and sending email messages to victims asking them their account information to verify their billing information and other information about their AOL accounts. The attacker lure, or fish the victims. This is when the word phishing began.

Although this social engineering technique had been around since the ’90’s it did not hit its popularity until the mid-2003. Phishing attackers, also called phishers creates very convincing emails requesting victims to click on links to update their account information. These emails and the redirecting website looks very closely similar to the actual website. Too convincing enough, a typical user would not spot the differences.

Some of the few tricks that these phishers would manipulate is to ask you to click on the link inside the email with a link almost the same as the actual website. For example, if you have an account with Bank of Alaska and their website is bankofalaska.com, they would create a site something like backofalaska.com. Or they would place @ symbol like bankofalaska.com@oursite.com. Before the @ sign would be the username following the http protocol. The actual website is oursite.com, which is a bad site. Depending on the way the site is written, the username can be ignored if it is not required.

Nowadays, there are so many newer techniques that phishers have developed in trying to convince potential victims into going into their trap. Some smart developers have found some ways to create java script to hide their actual URL or web address and show something else. So if someone checks the web address showing bankofalaska.com, it shows just that, but the script actually hiding the actual phishing site. Newer browsers should be able to detect these and warn you.

Other attacks come in the form of pop ups and the exploit of cookies. Phishers, who have developed a strict code to find if you are surfing, say, your bank account, will automatically trigger a pop up window that appears as it comes from your real bank. Unknowingly it was generated from the pop up script. That pop up dialog window would then ask you for your personal account information and other important things.

Phishing is still rising and staying on top. The Q1 2008 report from APWG (www.anti-phishing.org) shows there are still an average of 30,000 unique URL’s in that quarter report.

One of the countermeasures that we really need to start doing from within ourselves is “self-awareness”. There those small contributions that we can do to protect ourselves from phishing. Things like not clicking, or even opening emails, that came from some unknown sender. Or even if someone emailed you with a link, it is better to copy the URL and access it manually. Links on the email may direct you to somewhere else. And as always, DO NOT believe emails asking you to update your Account information or ask you for a password. Or even telling you that they will send you money to transfer from an African bank. These are all scams. It is a rule of thumb not to give out your password or critical account information via email or anyone who asked you for it.

Next time, I will extend the discussion of phishing to a wider scope such as attackers redirecting you to what appears to be a legitimate traffic, yet fake, with the techinique such as DNS poisoning. This is also called PHARMING.