Industry Trends

World Password Day: 6 Best Practices for Password Security

By Renee Tarun | May 02, 2019


Promoting Data and Network Security on World Password Day 

Insecure or inadequate passwords are an easy target for cyber criminals. Accessing a network using a stolen password is much easier than trying to break in through edge security protocols. Attackers can uncover or bypass weak passwords using brute force attacks, inject compromised credentials to gain access to user accounts using credential stuffing attacks, or leverage a host of other strategies to hijack user accounts to steal personal or corporate data.   

Today, May 2nd, is World Password Day. The goal is to promote better cybersecurity hygiene by upgrading easy-to-guess passwords or refreshing older passwords that may have been compromised through some data breach. Think of it as the cyber equivalent of testing and replacing the batteries in your home smoke detector. Being diligent about creating strong passwords and updating them regularly is the first line of defense in securing both your personal and corporate information. Maintaining strong passwords and having a password strategy you can easily manage—but that others cannot easily guess—is an essential cybersecurity effort that every employee and individual plays a crucial part in.

Weak Passwords Create Security Risks



Physical security of passwords is also important to keep in mind. The average US email address is associated with 130 accounts. With so many passwords to remember, many have admitted to writing passwords down on pieces of paper or keeping a list of passwords in unsecured documents on their computers. These items can easily fall into the wrong hands – whether they are simply lost or are compromised in a malware attack.

What Constitutes a Weak Password?



  • Birthdays
  • Phone numbers
  • Names including movies and sports teams
  • Simple obfuscation of a common word (“P@$$w0rd”)

Cyber adversaries are constantly tweaking their tradecraft to ensure successful intrusions in order to generate consistent revenue and profit. If your password is guessed or stolen or guessed, you may never know it happened until anomalous purchases appear in your bank account. And even more challenging, you may not be impacted directly at all. Data accessed by leveraging your compromised account may simply be used to move up the food chain, enabling an attacker to gain access to data and resources managed by someone else.

Implementing a strong passphrase is one of the easiest ways to protect yourself, your devices, and personal and corporate data from these cyber threats. The basic rule of thumb is, the longer and more complex the password, the more difficult it is to crack. However, unless done carefully, it can also be easier to forget.

6 Best Practices for Creating Secure Passwords

Passwords are like toothbrushes—you want to choose a good one, never share it, and replace it quarterly. The best password is a strong passphrase, impossible to forget and difficult to guess, even for someone who knows personal details of your life like the name of the street you lived on as a child. The worst kind of password is one that everyone uses, is easily guessed, or uses common phrases and words.

When creating new accounts or updating well-used passwords, keep these six best practices in mind to minimize password-based cyber risk.

  1. To add an extra layer of security, use multi-factor authentication wherever possible. This confirms your identity by utilizing a combination of multiple different factors, such as something you know or something they have, such as a token generator on your smartphone.
  2. Never repeat the same password for different accounts.
  4. Ensure no one is watching as you enter passwords.

Final Thoughts

When it comes to password security, everyone has a role to play in the protection of PII and corporate data. On World Password Day, IT teams and stakeholders should review the common risks of weak passwords with their organizations, as well as remind everyone of these best practices. This simple practice can help employees better protect their data, while minimizing unintentional insider threats to the organization.

Learn more about Fortinet’s education and training initiatives and efforts to close the cyber security skills gap in this blog post and video.

Read more about our Network Security Expert programNetwork Security Academy program.

Find out more information about our FortiVets program.