James Hanback. I know. It’s a common refrain. The public is given a variety of advice (sometimes contradicting) about what the victim could do to prevent it from happening every time an activist, prankster or malicious attacker enters a high-profile system. A Montana television station was recently in the news after someone guessed the password for the emergency alert system (EAS) and broadcast an alert that could remind horror movie buffs of the scene from Night of the Living Dead. The prankster said, “Civil authorities have reported that the dead are rising out of their graves and attacking those living,” over the air.
It turned out that the Montana station had not changed the default password to its EAS system. The prankster was able simply to guess the password to gain access to the system and broadcast the alert. Although this incident appears to have done no harm, panicked citizens have experienced false emergency alerts in the past. The most famous example of panic caused in a fictional emergency is the Halloween 1938 Orson Welles radio broadcast of H. G. Wells’ The War of the Worlds. Mashable.com reported, in addition, that the Montana station manager is worried that similar attacks against an EAS system might cause widespread panic due to reports of more realistic-sounding threats such as a terrorist attack.
For access to almost everything, passwords and personal identification numbers are used every day. CompTIA and Cisco have dedicated entire domains of certification exams that are not related to security to security. Even so, there seems to be a general disinterest outside of IT circles in creating strong passwords as they can be difficult to remember and cumbersome for users. IT professionals are usually responsible for educating and, if necessary enforcing strong passwords.
It is a good idea to change the default password before you connect any device to a network. This is because default passwords can be easily guessed and found on lists available online. It is equally important to ensure that your new password is strong. This means that it cannot be easily guessed and is as resistant to brute-force cracking as possible.
What is a strong password?
Expert opinions can vary. There are some general rules that have become a standard of advice. A strong password is defined by the online documentation of Cisco products as having the following characteristics:
At least eight characters
Few characters consecutively, such as “abcd”, or “1234”
Few characters repeat themselves
No dictionary words
No proper names
Both uppercase and lowcase letters are accepted
Numbers
Microsoft recommends similar characteristics, but suggests that you include punctuation as well as symbols in addition to letters and numbers.
The strength of a password will depend on the input that the device, system, or account you are protecting accepts. If the password input field only accepts numbers and letters, then you won’t have the ability to create a strong password that includes the dollar sign ($) or at the (@) symbols. You won’t be allowed to create passwords with more than seven characters if your password field is limited to seven characters.
The sheer number of online accounts, device accounts, corporate network accounts, and other accounts that average users have these days will make you want to rip out your hair. No matter how strong your password, you can easily weaken it.
