Following on from the article we wrote last year about protecting your website from hackers, we’ve produced this new guide to keep your website and the digital aspects of your business safe. At any moment, your digital footprint is at risk from malicious attacks and hacking, especially if it could be worth a significant amount of money to bad actors.
An important thing to bear in mind is that there is no such thing as being 100% resistant to hacking. You can do everything within your power to stop hackers, but ultimately it is a question of willpower. The best thing you can do is make it as hard as possible for someone to hack you, and we’ve gathered some tips to help you achieve this.
Strong Passwords
The first, and perhaps most obvious piece of advice is to use a strong password. There are many different ways to generate a password, and often you can use tools to help you generate a strong password. We previously posted a graphic on how increasingly complex passwords can deter hacking tools by taking longer to crack. As an example, a password consisting of 4 numbers can be cracked instantly - whereas a password consisting of 13 characters including numbers, upper and lower case letters, and symbols, would take 2 million years for current tools to crack.
The point is that every additional character in a password, and every additional type of character will make your password exponentially more secure.
On top of this, we have a new suggestion on best practice for generating passwords. In years past you might have been taught to generate passwords that look like a random string of numbers, letters and symbols. Whilst these types of passwords are still secure, they can often be a pain to deal with in the event that they have to be typed manually - and in the event that memorisation is needed, they are impossible to memorise. With that in mind, experts nowadays often recommend creating a passphrase.
Put simply, a passphrase is a password consisting of random words joined together. Most experts recommend a minimum of four words. This type of password is much easier to remember and type out, and can offer just as much security as the more widely known gibberish passwords. Here’s an example shown below:
ro)&eJa29X3p1a - This password has 14 characters and a complexity of 4 based on the chart in the previous article. This means there are 4 different types of character, with upper and lower case letters, numbers and symbols. We tested this password using an independent evaluator tool and found it would take 537 billion years to crack.
Apple-Bushcraft-Triangular-Mortgage-9 - This password has 35 characters and a complexity of 4, containing upper and lower case letters and symbols in the form of hyphens, as well as a number. Using the same independent evaluator, this password would take 989 trillion years to crack. As you can see, the length makes a big difference. Alternatively if the number was removed it would take 78 billion years.
Realistically, these time scales aren’t different from a practical point of view as they are not going to be crackable in any realistic length of time by man made tools. What does matter is the previously mentioned point that a passphrase is much more practical for regular use, whilst being just as secure.
Unique passwords and password managers
Just as important as using strong passwords, you should always use unique passwords for every single item you have a password for. Even if passwords cannot be cracked, things leak, platforms get compromised and determined hackers may even have other ways to get in. If you used the same password for 10 different accounts and one of them got compromised, you might lose access to every single account.
The most obvious question you will ask next is how 10 unique complex passwords can be remembered - and this is where password managers come in. It is very important to store your passwords in a secure place, but it is also important they are stored in a convenient and practical way. Password management tools are the solution to this, and offer advanced security features, often for free.
There might be a temptation to store passwords in a spreadsheet or other digital file on your computer or in the cloud, but this is a massive no-no. If these get compromised, which is possible, it puts all your data at risk. Putting passwords on physical paper carries the same risk too, as well as making it a necessity to manually type your passwords out for every use.
For illustrative purposes, we’ll go through how a password manager works using the features of Bitwarden as an example. Other password management tools are available. Bitwarden is a tool that you can attach to your web browser, or use in other formats like a desktop or mobile application. It allows you to save passwords into an encrypted database that is secured with a master password that you type in to access the database, meaning you only need to remember this one password. It is also secured with 2 Factor Authentication, or 2FA (Explained in our previous article). Having a secure master password you can remember as well as mandatory authentication from your mobile device ensures your passwords are stored as securely as possible.
The other benefit of tools like this is convenience. They allow you to easily save new passwords, and automatically fill your passwords when entering your online account by associating them with the address of the website you are on. This works on mobile too, and removes a lot of the stress from juggling and typing out different passwords. Lastly, these tools will offer a utility to generate new secure passwords for you, should you need them.
Final Tips
Here are some additional bits of advice we haven’t included in the main article.
- You should regularly check sites like HaveIBeenPwned, which tracks things like leaks and hacks of large companies and websites. You can check if any of your passwords or email addresses have been compromised and change them to keep yourself safe.
- Be wary of automatically selecting options like “Remember My Password” on websites and accounts, especially if you are on a device that is not your personal device. This is good practice to make sure your passwords are not being saved anywhere inappropriate.
- Think about the method of 2FA you choose for any passworded account. Authenticator apps, such as Google Authenticator or Authy are harder to get into than SMS based 2FA. These apps will generate a unique key for you on a rolling basis every minute or so, and are not tied to your phone’s SIM card. SMS based 2FA is simpler to set up, but is more vulnerable to things like SIM swap attacks. We should stress that any kind of 2FA is much better than none, and extremely hard to crack.
That just about wraps up this article. We hope this helps you keep all your digital properties secure. On a final note, advice like this doesn’t last forever. The technology changes, hackers get more sophisticated and new developments like AI make online security more complex. Always endeavour to stay up to date, now and in the future.
Thanks for reading.
