The good news is that you have some options. You could think about your users taking better advantage of Terminal Services to provide their desktop session, or you could consider Windows 7 or Windows 8.

Most of IT Partners runs on Windows 7, but a few of us have moved to Windows 8. I was initially very skeptical about Windows 8. The user interface is designed with a tablet in mind, except that same interface is now used for desktops and laptops. As an example, to close a full screen size application, you pull it down to the bottom of your screen. This action is quite natural when using a tablet, but not at all natural or intuitive for a desktop or laptop user. To see some of the changes you can go here.

One of the very cool things about Windows 8 is Windows To Go which is a fully manageable corporate Windows 8 desktop on a bootable external USB drive.  Yes that’s correct, those tiny drives! Keep in mind that to allow Windows To Go to run fast, you need one of the new ones which have both a lot of storage and fast access times, like these ones from Kingston. So you can take your USB drive home, plug it into your home computer, reboot, and you have your desktop from work, complete with all the apps and data that you use at work!

It seems like such a simple question, which should have one simple answer, like “eight characters, with at least one number and one special symbol”. Sadly, it’s not that easy.

There is no single right answer to this, as the answer depends on what you are trying to password protect.

In a perfect world, you would use a different unique password for every service you protected. This might sound like it would get unmanageable very quickly, but there are tools like LastPass which keep track of them all for you. Once you start using LastPass, you quickly realise that your passwords can be as long and complex as you like, as you no longer need to remember them, so go nuts! Use a 20 character randomly generated password for each site or service, secure in the knowledge that the only password you need to remember will be the one to unlock LastPass itself. We’ll talk more about how to come up with a strong and memorable password for this later.

Now, assuming you are using unique passwords per service, we can better answer the initial question of how strong they should be. The answer lies in considering the impact were that password to be compromised. For example, if you have a blog to which you post three times a year with cat photos, it might not really matter if this password was compromised. The worst an attacker could do would be to pretend to be you on that blog. Now, let’s say that as part of the “my account” section on that blog, you have your personal details. That might matter a little more to you, so maybe you want something a little stronger than “hello123” as a password.

Now think about your account for your work system. This allows you to create a VPN connection in to the office from home. What if this was compromised? An attacker could then access anything at your work that you can access. Depending on your position, this could be anything from emails revealing proprietary and commercially sensitive information to documents detailing company bank accounts, physical security, or all the personal data of every employee at the company. Not only that, but once they have access to the system as “you”, they may be able to exploit security weaknesses to gain administrative rights to the system, giving them the power to do anything that your IT department could do. So, a very secure password would be suggested here, and one you use nowhere else.

Why do I keep talking about unique passwords? Every so often, systems are compromised. This is simply a fact of life in the very rapid development world of information technology. Often, business needs drive development at speeds which do not allow all implications of security to be considered. Also, due to the massive complexity involved in modern software, testing every possible attack scenario is simply not possible as combinations of hardware, software, and simple human fallibility can be foreseen. You have probably seen real life examples of this, such as the recent MSD/WINZ security breach. While this one was certainly foreseeable and preventable (from our point of view), it doesn’t change the fact that one possible outcome is that the passwords of all WINZ staff are now available to an external party. If those staff members use the same password on multiple systems (think facebook, paypal etc.) there is a real and very frightening possibility of identity theft on a grand scale. Hence, always try to use a unique password for every service you use.

Now, the final part in this rather longwinded post! How should I choose a secure “master” password for a service like LastPass?

A useful method is the concept of a passphrase. Think of a phrase which is meaningful to you – a lyric, quote, or just a phrase you make up, and use it in full, with some number or character substitution to add even more complexity. Here are some examples, though I strongly recommend you don’t use these, for obvious reasons!

“What is my phone number? Why, it’s 021 555 1234!”

“Johnny’s in the basement, mixing up the m3d1c1n3”

Who knew passwords could be fun?

One final word. It can be very tempting to set LastPass to automatically remember your master passphrase, to save you the hassle of typing it every time you start your computer. Ask yourself then what happens should your computer be stolen or compromised? The results are potentially disastrous. Security begins and ends with you. No magic product or technology can remove from you the responsibility of securing your information or thinking about the consequences of any compromise.

By Greig McGill