One of the overlooked area many of us struggle with is password management. In our day to day computing activities, many of us would simply just use or chose to protect our assets with a simple password. These assets could be critical such as bank accounts, confidential data, or even health information. We are lacking the real work on password management.

Now, just what is password management really is? Well, in its very simplest form, managing passwords!

In corporate world, there are various technologies that does password management. In fact, password management is covered in a good scope on many of books for the CISSP exam.

Now, before going deeper to it, let’s magnify our glass to the word password itself. Many, if not all of us know what password is. That’s the word you write on your sticky note and hide it underneath your keyboard. Kidding aside.

Password is the most widely and commonly used authentication mechanism. They are also considered the weakest security mechanism. Users would simply choose very easy passwords such as their date of birth, favorite color, their nickname, etc., that are easy enough to guess. Sometimes too, they give it away to their buddies or best friends.

It is funny yet interesting to see how users typically thinks security is not one of the most important part of their computer. Not until someone hacks into their computer or account, then that’s when security is all the frustrations.

So here comes password management to the rescue. Although the scope of this article will dive only deeper to day-to-day users of computers, emails and services; it will touch a bit on the corporate world where I will cover some of the best ways in managing password. Bear in mind, this article does not go deeper in how to implement SSO technologies or token devices and such.

Simply put, you got to protect your treasured belongings with your best security. You wouldn’t really want to put your jewelries, money, and other important belongings into a carton box just lying around your doorstep. The same would you need to protect your emails, your computers, your accounts with a good password.

A good password is at least eight characters and contains a combination of upper and lower case and special characters. Try to choose something not closely related to you, such as your color, pet name, or belongings. An example would be “1Fo126iveYoU” is a strong password. “blue123″, while it contains letters and numbers, it is still vulnerable to dictionary and brute-force attacks. I am not going to explain those but in short, those are types of attacks a hacker can use to guess your password. There are many free and easy to use programs out there that can easily do the guessing.

Also, not writing your password where someone can read or see is a good countermeasure to remember. Sometimes, we often change our password similar to previous one but incrementing or decrementing other characters. Such as “PassWord1″ is your previous and “PassWord2″ is your new. If you wrote it down in a piece of paper and throw it away, an attacker can go to the trash bin and try to find them. This technique is also called Dumpster Diving. So be aware, not because you are done with your password doesn’t mean they still cannot use it to guess your other passwords.

There are systems nowadays that will ask you for phrase instead of a password. These are called passphrase. So instead of entering “password 123″, you might be asked to key in “let me in this is me”. Also other systems do a different way by allowing you to enter cognitive password. Cognitive password are opinion- or fact-based information. These are usually derived by answering questions related about your life. The answers are then transposed to a virtual password.

In systems where we are only required to put our password, it is your duty to secure it. I’ve covered few ways to secure your password here but there are other many ways you can do on your own. Something I did not cover which is beyond the scope of this article is the implementation of encryption or token device to ensure that the password of user are not sniffed, eavesdropped, or captured by attacker for a replay-attack. These countermeasures are for security professionals to implement technical or logical controls in their enterprise.

The use of password synchronization, assisted password reset, and self-service password reset are few approaches you can implement in your enterprise to assist users reset their password and not being compromised during resets. Those are the real “password management” discussion.

As end users, protect your password as if it is the key to all your belongings. Remember, attackers can sniff them (so corporate should implement encryption), can brute-force guess them (apply hard-to-guess strong password), or they can steal them (using techniques such as dumpster diving, shoulder surfing, keyboard monitoring). Shoulder surfing is when someone is looking over your shoulder or back as you type in your password.

Next time, I will try to cover in details some of these attacks that you really need to be aware of.