Blog

Online security breaches have been national headline news topics regularly throughout the last year. WebWise Design & Marketing has always taken security seriously. We have used and stressed the importance of strong passwords, and we endeavor to keep the versions of the applications we use updated as quickly as possible.

As most of you know, websites with Content Management Systems (CMS), by their nature, present a far greater security risk than static websites. Simply having a user login facility creates a security challenge. Hosting companies and other companies that provide security products and services tell nearly everyone who will listen that, “In our experience most account compromises are due to weak passwords and/or outdated software.”

Last week we took another step in securing our client websites that were built on a WordPress framework. We have installed the Wordfence Security plugin on nearly all the WordPress installations we developed and manage.  While there are other similar products, we use and recommend Wordfence Security (we have no affiliation). Here are some of the features of the free version.

Real-time Security Network Enforce strong passwords Check existing passwords Scan for DNS changes Get detailed IP info Track IP’s to their source Block IP’s & manage blocks Intelligently block networks Block fake Googlebots Block brute-force attacks

Scan Core, Theme and Plugin Files Repair Files Scan for known malware Scan for hundreds of backdoors Scan content for bad URLs Real-time traffic shows hackers Real-time view of crawlers Includes a complete firewall Rate limit rogue crawlers View top content leeches

You may have noticed one of the features is “Enforce strong passwords.” By default, we use that setting for our client’s protection and recommend that everyone use the feature. Read our Secure Passwords Should Not Be Optional blog post.

While the free version of Wordfence Security does an excellent job across the board, we believe the investment in Wordfence Premium is a good investment in the security of anyone’s website. Take a look at it and decide for yourself. www.wordfence.com

A very large number of the security breaches we read about are because of weak passwords. Nearly all of us are guilty of using insecure passwords. Some of the time it isn’t a big deal. If someone steals your password to your favorite newspaper account, it likely doesn’t matter as much to you as it does to your newspaper company. Of course, if you stored credit card information there, it could be a bigger problem for you than you think.  The bottom line is if you don’t want any of your accounts and the information in them accessed by someone else, you need to use a very secure password.

So, what constitutes a secure password? Let’s start with the basics. The longer the password, the harder it is to crack. Consider using at least a 12-character MINIMUM. We like to see 20 – 24 character passwords. Okay, so we agree you should use long passwords.

What else? Before you create that first really secure password, make sure you protect your computer and network with up-to-date antivirus software and a firewall. The most secure password in the world is not secure if it is in an unencrypted file (Word document, text file, spreadsheet, etc.) on a computer that has been compromised.  If any of the accounts you access offer two-factor authentication, use it! Many experts recommend periodic (and somewhat frequently) password changing. I agree with Leo’s answer on Ask Leo to this question. Is a periodic password change a good thing?

Back to creating that long password.

• Create passwords using a 12-character MINIMUM. Using 20 – 24 characters increases password strength exponentially.
• Use at least one number, one uppercase letter, one lowercase letter and one special character (symbol).
• Don’t use the names of your family members, friends or pets.
• Don’t use dictionary words, including commonly used foreign words.
• Don’t use common substitutions such as “$” for “s”, “@” for “a”, “1” for “l” and, well, you get the idea.
• Don’t use zip codes, local street numbers, phone numbers, birthdates, ID card numbers, social security numbers, etc.
• Don’t use the same password on multiple sites.

Password Generators

We recommend using a password generator, and creating them at least 20 characters long. There are several good secure password generators online. Here are a few.

Norton Identity Safe Password Generator
Random Password Generator
Online Domain Tools Password Checker
Perfect Passwords — GRC’s Ultra High Security Password Generator

For those of you who want to remember your passwords. It is possible to use really long passwords that are easy to remember. Here is an excellent blog post which includes methods to do that.

Password Managers

How to remember those long passwords? Well that is a challenge. We recommend using a password manager application. Because LastPass, one of most widely used password managers, was broken into last month (hackers didn’t access user password vaults because it uses a rigorous cryptography system), some believe using a password manager is not a good idea, but it is a very viable option. This blog post answers the question, “Am I An Idiot for Still Using a Password Manager?”

There are two types of password managers, those online that store your passwords in encrypted databases in the cloud, and applications that you install, and then store your encrypted password database on a file on your desktop computer, phone, or tablet. There are pros and cons to both types, and both can do the job for you. Here are some of the most popular password managers.

LastPass
Dashlane
1Password
KeePass

Here is how PC Magazine rates (June, 2015) paid and free password managers. Please remember that those ratings, as all ratings of software, are somewhat subjective and a matter of personal preference.

Start today with creating a new and different password for each of your email accounts. Most of us have easy-to-remember (and easier to crack) passwords for our email accounts that really should be changed.

Please remember,  Secure Passwords Should Not Be Optional, and using a password manager certainly doesn’t make you an idiot.