This week we would like to talk about password management. Compromised credentials are one of the biggest factors in lateral movement during a breach. It's important we're thinking about how we protect our passwords. Here are some tips to help you manage your passwords more effectively:
Use a password manager
It does not matter if you choose KeePass, LastPass, OnePass, it's important you're using a password manager. These allow you to configure unique passwords for each service you use while only needing to retain one "master password."
Never re-use passwords
Using the same password for multiple services exposes your data to unnecessary risk. If an attacker were able to compromise your Facebook password, it's not really a big deal. But if that also happens to be the password for your bank account, then you see an exponential increase in risk. Instead, use a password generator to create strong, complex passwords that are unique to each service.
Change Passwords Regularly
Some password manager, such as KeePass, have a password aging function which alerts you to change your password at a defined interval. Best practices suggest users should change their passwords every 90 days, as part of their personal security plan.