Advanced Password Services (APS) Guide › About Password Security › Keeping Passwords Safe

Keeping Passwords Safe

There are tricks to creating a good password that can't be easily determined yet can be remembered. System Administrators often set up strict password guidelines for their users. Here are some common DOs and DON'Ts:

DOs

• Use a password that contains non-alphabetic characters, e.g., digits or punctuation.
• Use a password that is easy to remember so that you do not have to write it down.
• Use a password that you can type quickly, without having to look at the keyboard. This makes it harder for someone to steal your password by looking over your shoulder.
• Change your password periodically.
• Change your password if you suspect that your account has been compromised.

DON'Ts

• Use your userid in any form (reversed, capitalized, doubled, and so on)
• Use your first, middle or last name in any form. Do not use your initials or any nicknames you may have.
• Use your spouse, significant other's, or child's name.
• Use a word contained in English, or foreign language dictionary.
• Use other information easily obtained about you. Examples include your telephone number, identification number, brand of your automobile, etc.
• Use a password of all numbers, or a password composed of the same character.
• Use a password shorter than seven characters.
• Write your password on desk blotters, calendars, or store it on-line.
• Reveal your password to anyone.

As a security precaution, many companies analyze their employees' passwords using the very same tools that attackers use. This is a good practice, but in most cases, the only way to ensure that password guidelines are followed is to have users change passwords through software that enforces the rules.