I will be going on Holiday soon, and I am concerned that my colleagues may not be able to get to information that is stored on my system. Is it OK for me to give them my password?

No, you should never share your password with other people. Although you may trust your colleagues, you should not provide them with your password. Your password uniquely identifies you to the various systems you access, and you may be held responsible for any activity that occurs under your account. Instead of sharing your password, make arrangements to have the data your colleagues need accessible to them. Some applications also allow you to designate a surrogate for your account. A surrogate may perform actions in your name, but their access will be traceable back to them. Check with your IT department for more information.

Our organization uses an application that stores very sensitive information. Is it enough to protect it with the usual account name and password?

While password protection is the most common method used to restrict access to information, you may want to consider additional protection for very sensitive information. One way to add protection is to use two-factor authentication. Two-factor authentication is usually deployed as a combination of password authentication, and the use of a smart card, token, or biometric input (such as fingerprints or a retinal scan). As more than one method of authentication is needed for access, it is less likely that a hacker could defeat the protection.

I have a lot of accounts and passwords, and it is difficult for me to keep track of them. Can I just write them down?

It is not advisable to ever write down your account names and passwords on paper or a sticky note, as they are easy to lose. Instead, consider using an encrypted password storage program if you need to keep track of multiple passwords.

I have multiple accounts at work and at home. Can I use the same password for all these accounts?

You should not use the same password for different accounts, especially not for work accounts and home accounts. If your password on any of these accounts is compromised, all of the accounts will be compromised. You should use different passwords at work and at home.

Why does my organization make me change my password every 90 days?

Most companies have a password age policy that requires you to change your password every so often. The reason for this is to limit the damage that a hacker could do should they happen to obtain your password. Even if your organization does not have such a policy it is a good practice to change your password on a regular basis. It is also a good idea to do this with your personal accounts too, such as for online banking.

What are the characteristics of a good password?

• Is at least eight characters in length
• Contains a mixture of upper and lower case characters
• Contains numbers
• Contains special characters

Do you have any hints I could use to create a strong password that is also easy to remember?

One way to create a strong password that is easy to remember is to use a passphrase. Think of a phrase that you can easily remember. Then use elements of this phrase, such as the first two letters of each word, to create your password. Add in a mix of numbers, cases, and special characters, and you have a good password that is also easy to remember.

What are some behaviors I should avoid when creating a password?

Avoid sequences or repeated characters

I change my password at least every 90 days, but I alternate between two passwords as this makes it easier for me to remember them. Is this a good practice?

No. When you change your password, you should not change it to a password that you recently used. Hackers may keep passwords they have obtained for a period of time, and try them at regular intervals. It is best not to re-use old passwords when picking a new password.

Why should I use a strong password? It is much easier for me to remember a word rather than a combination of letters, numbers, and special characters.

Strong passwords are needed in order to make it more difficult for hackers to guess your password. A common hacker tool, called a password cracker, attempts to guess your password by using all the words in the dictionary, and even some common variations. Using a strong password makes it less likely that a password cracker will succeed in guessing your password.