Why use a Strong Password?

You’ve probably heard the advice the Police offer to households to reduce the risk of burglary. Make sure Windows and Doors are cloBurglarsed and locked, use good quality strong locks on doors and windows, use a Security Alarm preferably with different zones, don’t leave tools lying around outside the home that will make an intruders job easier.

Good advice isn’t it? We all want to keep our homes and belongings safe and sound.

At a guess, if your home was broken into then you probably wouldn’t shrug your shoulders and say it was “one of those things”. Even if nothing of value was taken, you’d probably still feel disturbed that somebody had gained unauthorised access to your property and belongings.

So stop and consider for a moment – how would you feel if the same thing happened and somebody gained unauthorised access to your company computer systems?


We recently helped a client migrate their systems from a peer to peer network to a Windows Small Business Server 2008 (SBS 2008) network with central file storage, e-mail and strong security.

In the previous peer to peer network, the security was very minimal. Users had passwords, but they never changed… ever. Passwords were often the same as the user-names, or were very simple – cat, dog, that sort of thing. Files were shared amongst everyone in the system without any permission structure in place.

In effect, anyone who had access to the network had access to ALL the network, and that anyone could include anyone who could guess a logon user-name and password. So let’s be honest, ANYONE!

SBS 2008 takes security seriously, and after implementing the new network infrastructure we talked to the client about the new strong password policy they would have in place. The client had lots of questions, many objections to the new way of working (“But we’ve always done it this way”, “I don’t see the point”, “People won’t remember all that”) and generally a resistance to change. This is human nature – change is difficult, but people are adaptable.

So we explained to the client the pro’s of a Strong Password policy, and the huge disadvantages of sticking with a weak password system.

So what is the difference between a Strong Password Policy, and a Weak Password system?

A weak password provides attackers with very easy access to your computer system. Strong passwords are considerably harder to crack (or break) – and that’s even with the powerful password-cracking software that is available today. Password-cracking software continue to improve, and the computers that are used to crack passwords are growing more powerful than ever. Password-cracking software generally uses one of three different approaches: intelligent guessing, dictionary attacks, and brute-force automated attacks that try every possible combination of characters. Given enough time, the automated method can crack any password. However, strong passwords are much much harder to crack than weak passwords. A secure computer system has strong passwords for all user accounts.

A weak password:

  • Is no password at all.
  • Contains your user name, real name, or company name.
  • Contains a complete dictionary word. For example, Password is a weak password.

A strong password:

  • Is at least seven characters long.
  • Does not contain your user name, real name, or company name.
  • Does not contain a complete dictionary word.
  • Is significantly different from previous passwords. Passwords that increment (Password1, Password2, Password3 …) are not strong.
  • Contains characters from each of the following four groups – Upper-case letters, Lower-case letters, Numerals.

A computer system or network should have a mandatory password policy put in place. This policy will dictate that passwords must be strong, meeting the above criteria, and also be changed after a set period of time – say, 42 days.

If all of this sounds rather a chore, ask yourself the question – should I adopt a strong password policy now…. or after an unauthorised user has gained access to my files? This isn’t scaremongering and it’s not a case of if, it’s a case of when. We regularly see random hacker attacks on *all* our client systems – even those with security in place. Generally these are random attacks probing for weaknesses. But think about this… to use the Household Security analogy again, which house do burglars target, those without signs of security, or those with windows and doors left open. The same is true of Computer Security – by adopting strong security policies, you don’t eliminate the risk of attack, but you do become a less attractive target.

Q – Couldn’t we all just use this same password? It makes it easy for us to log on.

A – You could all use the same password, as it would make it easy for everyone to logon, but that everyone might include the cleaner, the security guard, Mary in Finance, whose teenage son who has popped into the office to wait for Mom to finish work, hackers trying to access the network from the Internet, an employee checking out his appraisal compared to his colleagues, a disgruntled staff member looking to destroy some data, or worse, your competitor who has gained access to your network. By having individual strong passwords for each user, you’re drastically reducing the risk of these scenarios, or similar, ever occurring.

Q – The boss and our HR department need access to everybody’s files and e-mails – can we use strong passwords but force everybody to write them down so colleagues can access them?

A – If a member of staff writes his password down on a post-it note in his desk drawer, or worse, attached to his monitor, then that password isn’t secure at all and the whole system becomes vulnerable. You could get every member of staff to write their password down on a piece of paper kept centrally, say with HR or the boss, but as passwords are best changed every 30-40 days, this will turn into a laborious exercise in administration very quickly. A better solution would be to simply dynamically give the boss or HR  department access to those files or e-mails they need to from their own logon and computer as and when needed, or less preferably but if necessary, give them permanent access to all those resources from their own logon and computer.

Q – Can we ask the IT department to tell us what Joe or Dave’s password is?

A – The IT department don’t have access to users existing passwords, they can only reset these passwords to something new. This creates an audit trail of who changed a password and when.

Q – When Joe is on holiday or off-sick, Dan needs access to their files and e-mail – if Dan hasn’t got Joe’s password to log on to his computer, how can he cover his work?

A – Rather than sharing passwords and logging on to a computer as Joe, Dan can be given access to Joe’s e-mails and files from his own computer and logon. This could be temporary, so when Joe returns from his absence Dan no longer has access to his files or e-mails.

Q – We have folders that we’d like password protected, is this possible?

A – If you’re following the advice we’ve given previously, with every user having their own logon and password, then any file folder can have very granular security, allowing or denying a single user or group of users access to those files or sub-folders. For instance, you may have a Public Folder containing four folders – Staff Information, Design Drawings, Accounts and HR. Everybody in the company needs access to Staff Information. Everybody needs access to Design Drawings, but only the Design Staff should be able to modify or delete files within that folder. Only the Finance Department and the boss need access to the Accounts folders, and only the HR department need access to the HR folder. It’s very simple to set-up granular permissions for this scenario, provided everybody has their own user-name and password.


If you’ve not got a Strong Password policy in place – then why not? Be honest with yourself – are you ignoring that advice from the Police and leaving the windows and doors to your home wide open? Or are you being realistic, realising that threats do exist and you can mitigate this risk by taking reasonable steps?

Thoughts and your own computer security advice welcome! If I can offer any advice or point you in the direction of an IT company who can help you with your own requirements, don’t hesitate to get in touch!


Richard Tubb is an Independent Consultant who works with IT companies to enable them to feel more in control and to grow their businesses. He is also a Microsoft UK Small Business Specialist Partner Area Lead (PAL). You can e-mail him at richard@tubblog.co.uk or connect with him via Twitter and LinkedIn .


6 Responses to “Why use a Strong Password?”

  1. 1 Chris February 24, 2010 at 8:43 am

    Ric… Once again, brilliant blog post from the TUBBMASTER … I have been talking with a customer about the very same thing, and so I may use some of your stuff in the document that I give to them.,

  2. 2 Richard February 28, 2010 at 9:44 am

    Chris – thanks for the feedback, feel free to SWIPE away for use with your own clients. 🙂

  3. 3 ragaius October 26, 2011 at 4:50 am

    I know it has been almost 2 years since the last post regarding this excellent article but my employers have been questioning the need for strong passwords and this site came up in my research. Since the Windows administrator password on a stolen laptop can be reset with easily obtainable tools, why should they bother to use a strong password? This is the question I’m getting.

    The argument I am making is that weak passwords are easily stolen by guesswork or shoulder attacks from a malicious user who may not be able to steal the machine, thus gaining access in an unguarded moment. Combined with reasonable user precautions like locking their machines and being aware of who is around when typing a password, strong passwords make it much more difficult to get compromised.

    Was wondering if I’m missing any other good arguments?

    • 4 tubblog October 26, 2011 at 7:40 am

      Thanks for the kind words – I’m glad you found the article useful!

      In terms of laptops, I’d argue that using some form of encryption for data and/or laptop security software would always be wise. That said, unless the laptop is targeted and stolen specifically for its data (and most I’d say are stolen purely for the hardware) then a strong password would deter most typical thieves from trying to get at the data on the hardware.

      Your employers argument about not bothering to use a strong password because it’s possible to crack them is akin to saying they also won’t bother with a security alarm on the office because an experienced burglar could disable the system.

      Just my $0.02 🙂

  4. 5 ragaius October 26, 2011 at 2:31 pm

    Much thanks for the quick reply! I can use that argument 🙂 We are implementing whole disk encryption and the users are somewhat disgruntled that they will have to remember a strong disk password AND a Windows password. They are hoping for a free pass on an easy Windows password. Not going to happen.

    In spite of this I am starting to feel that strong passwords are becoming obsolete in the sense that in order to provide real protection they should be at least 20 characters. Most end users can’t be made to do that reliably.

    • 6 tubblog October 26, 2011 at 6:24 pm

      Another option to consider is Two-Factor Authentication. A password and a qualifying code from a token is a very secure method. Many “tokens” nowadays can be apps running on iPhone and Android too.

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s


Tubblog on Twitter


Enter your email address to subscribe to Tubblog and receive notifications of new posts by email.

Join 48 other followers

Microsoft Small Business Specialist Logo
Computer Weekly Blog Awards 2010 Logo
MSP Mentor 250 Logo
SMB 150 List Logo
International Association of Microsoft Channel Partners Logo
MyFreeCopyright.com Registered & Protected

%d bloggers like this: