Make It Harder to Get In: Strong Passwords, Password Managers & Smarter Credential Security
This Cybersecurity Awareness Month, the IT-ISAC is highlighting four foundational pillars of digital security to help strengthen resilience across users and organizations. We’re kicking off the series with the first topic: Strong Passwords and Password Managers — your primary defense in safeguarding against unauthorized access.
Attackers do not always need to break in. Sometimes, they can simply log in.
Stolen, reused, guessed, or exposed credentials give cybercriminals a direct path into your organization’s data. Whether through a weak password, a convincing phishing email, or a third-party breach, these exposures can quickly turn users into open doorways for attackers.
That is why credential security remains one of cybersecurity’s most critical fundamentals. During Cybersecurity Awareness Month, the IT-ISAC is reinforcing a simple message: Make It Harder for Attackers. And one of the most effective places to start is at the front door, by making it harder for attackers to gain access in the first place.
Step 1: Master the Fundamentals
Protecting your credentials starts with the basics. These core practices apply to both individuals and organizations:
Go Long and Stay Unique: Password length beats complexity alone. Aim for 16 characters or longer. Avoid obvious personal details like birthdates, pet names, or hometowns. Reusing a password means one breach can compromise multiple accounts, so keep every credential unique.
Adopt Passphrases: Combine unrelated words into a memorable sentence (catsusecomputers!). Take it further by weaving in numbers or special characters (Cats63useComputers578!).
Use a Password Manager: Remembering dozens of long, unique passwords or passphrases can be impossible without help. Password managers safely generate and store credentials in an encrypted digital vault, requiring you to remember only one secure master password.
Upgrade to Passkeys: A passkey is a modern, passwordless login method that lets you sign in to websites and apps using your device's built-in security, such as your fingerprint, face scan, or PIN. Because passkeys use cryptographic key pairs unique to each site, attackers can't guess them, steal them in a data breach, or trick you into giving them away through phishing.
Clean Up and Respond Quickly: Change exposed or compromised credentials immediately. Regularly audit and remove inactive user accounts, former employee access, and unnecessary privileges to close any doors a threat actor might slip through.
Step 2: Go Beyond the Fundamentals by Making Credentials Less Useful to Attackers
While strong passwords are a crucial starting point, attackers use sophisticated techniques like credential stuffing (using one breached password to try and gain access to multiple accounts), password spraying (a type of brute-force attack where criminals will try small sets of common passwords across many accounts), info-stealing malware, and social engineering to bypass basic controls.
Organizations must move beyond asking "Is this a strong password?" and start asking "How difficult are we making it for an attacker to steal, reuse, or exploit our credentials?" Going beyond the fundamentals means taking a more holistic approach:
Protect High-Value Accounts: Identify privileged, administrative, and other high-impact accounts that could give an attacker broad access. Apply stronger authentication requirements, tighter access controls, and additional monitoring around these accounts.
Audit Non-Human Credentials: Service accounts, API keys, tokens, and application secrets can provide powerful access without a person ever signing in. Maintain an inventory, limit permissions, rotate credentials regularly, and remove those that are no longer needed.
Monitor for External Exposure: Watch for organizational credentials that appear in third-party breaches, credential dumps, or infostealer logs. Early detection gives security teams an opportunity to reset credentials and investigate potential compromise before attackers can take advantage of them.
Secure Recovery Pathways: Password resets and account recovery processes should not become an easier way around stronger authentication controls. Review recovery methods, help-desk procedures, and identity-verification processes to ensure attackers cannot simply bypass the protections at the front door.
The goal isn't just to enforce complex rules; it is to make your credentials harder to steal, harder to misuse, and ultimately, completely useless if an attacker gets hold of them.
Questions Every Security Team Should Ask
Cybersecurity Awareness Month is an ideal time to evaluate whether your policies work as effectively in practice as they do on paper. Take time to assess:
Are we requiring long, unique passwords and giving employees an approved password manager to use?
Where can we reduce our reliance on passwords by introducing passkeys?
Which credentials would create the greatest impact if compromised?
Do we know what privileged accounts, service accounts, API keys, and other high-value credentials exist?
Do we know who owns, manages, and/or has access to them?
Are we monitoring for credentials that may have been exposed outside our environment?
How quickly can we revoke, disable, or reset a credential we believe has been compromised?
How secure are our password reset and account recovery processes?
Are inactive, legacy, or unnecessary accounts increasing our exposure?
Strong Credentials Are the Beginning, Not the End
Even the strongest passphrase or passkey shouldn't have to defend an account alone. Credential security works best when integrated into a layered, multi-tier defense strategy.
That brings us to our next Cybersecurity Awareness Month focus area: multi-factor authentication (MFA). MFA adds an essential extra barrier between a stolen credential and system access, ensuring that an exposed password doesn't automatically equal a compromised network. We’ll discuss this topic more next week, so stay tuned!
Lastly, defenders don't have to tackle these threats in isolation. By sharing threat intelligence with community peers, we help the entire sector stay ahead of threat actors. Start with the fundamentals. Eliminate the gaps. Make it harder for attackers.
Comments