How Often You Should Change Your Password?
A recent news which was rampant all over social media that “a cybersecurity firm said Wednesday that it found millions of records openly exposed on the internet containing people’s personal data from Facebook, including passwords for 22,000 people.” UpGuard said in a report on its website that app developers had collected the data by building off the Facebook platform, a method similar to the one used years ago by app developers in the Cambridge Analytica scandal to build detailed datasets about millions of Facebook users.
The latest leaked datasets, including people’s likes and interests, was publicly accessible on Amazon-owned servers until after UpGuard found the files and began investigating during the past few months, the company said.
When it comes to security, complicated isn’t always better. There are many people out there who want you to believe that strong security means buying lots of expensive software, following complex rules, and conducting endless research on today’s latest threats.
Use strong passwords, store them in a password manager, and turn on multi-factor authentication everywhere you can. These basic steps alone will help most people keep their accounts safe. In the article, we are going to share and idea with you that how often you should change your password.
Frequent password changes make things worse
For years, security professionals recommended changing passwords every 30, 60, or 90 days. In offices worldwide, IT policies forced employees to regularly change their password.
The result? Password security is in a terrible state. Employees have too many passwords to remember. Corporate policies are too strict, so employees write them down, make them as memorable as possible. People skirt the rules, so they can keep doing their jobs with minimal disruption. Whether at work or at home, we tend to display the same bad password behaviors everywhere.
NIST no longer recommends frequent password changes
Last year, the National Institute of Standards and Technology (NIST) published new recommendations in their “Digital Identity Guidelines”. The recommendations include decreasing both password complexity and the volume of forced password changes.
If NIST themselves are recommending against frequent password changes and admit that draconian password measures don’t improve security, then I think we should all consider their advice. Also, if you’re like me and have over 300 accounts to keep track of, changing them every month just isn’t realistic.
When should you change a password?
Now, this doesn’t mean you can avoid changing passwords ever again. There are key times when you should change a password.
- After a service discloses a security incident.
- There is evidence of unauthorized access to your account.
- There is evidence of malware or other compromise of your device.
- You shared access to an account with someone else and they no longer use the login.
- You logged in to the account on a shared or public computer (such as at a library or hotel).
- It’s been a year or more since you last changed the password, especially if you don’t have multi-factor authentication enabled.
In all these cases, updating your password is a smart precautionary step. A new password ensures that someone can’t abuse your account even if they have the old password.
How you should approach password changes
Use the above recommendations as a guideline for approaching password updates going forward. To save you time and help you be smart about making password changes, I also recommend the following:
- Put every password in a password manager. It’s much harder to know when it’s time to update a password when you have no idea how many accounts you have. You should collect all of your accounts in one safe place. A password manager like LastPass stores all your passwords in a vault, where they’re organized and encrypted for safekeeping.
- Audit your passwords. Let’s say you do have all your passwords collected in a vault. Great! Now you can use the LastPass Security Challenge to audit them. You’ll see just how many logins you have stored, and even find out which ones need a new password.
- First change weak, reused, and compromised passwords. The Security Challenge identifies those passwords that are at greatest risk. Use the results to prioritize updating weak, reused, and compromised passwords.
- Prioritize sensitive accounts next. Once you’ve eliminated all weak and duplicated passwords, be sure to update your most important passwords, too. Those may be passwords for banking, investments, email, social media, medical records, and taxes. Credentials for Amazon, Netflix, Hulu, and similar streaming and shopping services are also hot commodities on the dark web, so be sure those are strong, too.
- Use the automatic password change feature to speed things up. LastPass can automatically change your password for you on nearly one hundred of the most popular websites. LastPass launches the website and does all the work of changing the password for you in the background, so you can instantly enjoy stronger passwords.
- Turn on multi-factor authentication where you can. We’ve said it before and we’ll say it again. Multi-factor authentication is one of the best ways to slow down or prevent an attack, even when someone steals your password. Be sure to turn it on everywhere you can.
- Set aside time every year to update old passwords. Once you’ve completed the above, don’t go overboard updating your passwords frequently. Unless you know yourself to be a target, the above steps should be enough to protect your accounts. Just set a note in your calendar to run the Security Challenge at least once a year. Block time to update the passwords now flagged as “old”.
Now my advice is to set up a good password system, aided by a password manager. Once you are organized and have done the initial work to clean up your password security, it’s much easier to maintain that strong security going forward.
Reference : lasspass.com