Skip to content

password-security.md

Latest commit

 

History

History
242 lines (174 loc) · 5.16 KB

password-security.md

File metadata and controls

242 lines (174 loc) · 5.16 KB
Raw

Password Security

Overview

Password security is one of the most important areas of cybersecurity awareness. Weak, reused, or stolen passwords can lead to account compromise, data exposure, unauthorized access, and business disruption.

This document explains password security from an IT support and user awareness perspective.

Purpose

This guide demonstrates knowledge of:

  • Strong password practices
  • Passphrases
  • Password reuse risks
  • Password managers
  • Multi-factor authentication
  • Password reset safety
  • Common help desk security concerns

Why Password Security Matters

Passwords protect access to:

  • Email accounts
  • Workstations
  • VPN
  • Cloud services
  • Financial systems
  • Customer data
  • Administrative systems
  • Business applications

If a password is compromised, an attacker may gain access to sensitive systems.

Common Password Risks

Risk Example
Weak passwords Password123
Reused passwords Same password used for work and personal accounts
Shared passwords User shares login with coworker
Written passwords Password stuck on monitor
Phishing User enters password into fake login page
Credential stuffing Attacker tries leaked passwords
Default passwords Device left with default admin password

Strong Password Guidelines

A strong password should be:

  • Long
  • Unique
  • Hard to guess
  • Not reused
  • Not based on personal information
  • Not shared
  • Stored securely

A passphrase can be easier to remember and stronger than a short complex password.

Example passphrase style:

BlueCoffeeTrainRiver29!

Do not reuse this example as a real password.

Password Length

Longer passwords are generally stronger than short passwords.

Better:

Correct-Horse-Desk-River-47

Weaker:

P@ss1

Avoid Personal Information

Do not use:

  • Name
  • Birthday
  • Child's name
  • Pet name
  • Phone number
  • Address
  • Favorite team
  • Company name
  • Common keyboard patterns

Password Reuse Risk

Password reuse is dangerous because if one website is breached, attackers may try the same password on other services.

Example:

Same password used for personal email and work VPN.

If the personal account is breached, the work account may be at risk.

Password Managers

Password managers help users create and store unique passwords.

Benefits:

  • Generate strong passwords
  • Store passwords securely
  • Reduce password reuse
  • Help identify weak passwords
  • Reduce need to memorize every password

Use only company-approved password managers for work accounts.

Multi-Factor Authentication

MFA adds an extra layer of security.

Common MFA types:

  • Authenticator app
  • Hardware security key
  • Push notification
  • SMS code
  • Phone call

Important reminder:

Never approve an MFA prompt that you did not initiate.

Password Reset Best Practices

For IT support:

  • Verify user identity first.
  • Use a temporary password only when required.
  • Require password change at next sign-in.
  • Never ask the user to reveal their password.
  • Never write passwords in tickets.
  • Avoid sending passwords by plain text email.
  • Watch for repeated reset requests.
  • Escalate suspicious requests.

Account Lockout Causes

Repeated lockouts may be caused by:

  • User entering old password
  • Mobile phone email app using old password
  • Outlook saved credentials
  • VPN saved password
  • Mapped drive using old credentials
  • Windows Credential Manager
  • Service account misconfiguration
  • Possible unauthorized access attempts

Credential Manager Check

On Windows:

control keymgr.dll

Review saved credentials related to:

  • Email
  • VPN
  • File shares
  • Microsoft 365
  • Internal applications

Remove or update old credentials only with user approval and according to policy.

Signs of Possible Password Compromise

Escalate if:

  • User reports unexpected MFA prompts
  • Password reset emails appear unexpectedly
  • Account sends emails user did not send
  • Inbox rules forward mail externally
  • Login activity appears unusual
  • Account locks repeatedly
  • User clicked phishing link and entered credentials
  • Multiple failed login attempts are reported

User Education Tips

Tell users:

  • Do not share passwords.
  • Use unique passwords.
  • Use MFA.
  • Report suspicious login prompts.
  • Avoid clicking unknown links.
  • Use approved password manager.
  • Lock screen when away.
  • Change passwords if compromise is suspected.

Example Ticket Note

User reported repeated account lockouts after password change.
Verified identity and checked account status.
Unlocked account and reviewed common saved credential locations.
User updated password on mobile email app and VPN client.
No further lockouts occurred after retesting.
Ticket resolved.

Best Practices for IT Support

  • Follow identity verification procedures.
  • Keep password resets secure.
  • Do not expose sensitive details in tickets.
  • Document actions clearly.
  • Escalate suspicious account behavior.
  • Encourage MFA use.
  • Follow company password policy.

Skills Demonstrated

  • Password security awareness
  • Account lockout troubleshooting
  • MFA awareness
  • Credential Manager awareness
  • Secure help desk process
  • Security-focused documentation