6.5 Explain password best practices.
📘CompTIA ITF+ (FC0-U61)
Definition:
Password reuse happens when a person uses the same password for multiple accounts or websites. For example, using the same password for your email, your online storage, and a work system.
While it might seem convenient, password reuse is very risky in IT security.
Why Password Reuse is Dangerous
- One Breach Can Affect All Accounts:
- If one website or system gets hacked and your password is stolen, attackers can try the same password on your other accounts.
- This is called credential stuffing. Hackers automatically test stolen passwords across multiple sites to gain access.
- Easy Target for Hackers:
- Attackers know people often reuse passwords. Once they get one password, they can access multiple accounts quickly.
- Impact on IT Systems:
- In a company environment, if an employee reuses a password from a less secure site for the corporate email or internal systems, it can compromise the whole network.
- Sensitive data like customer information, company documents, and internal tools can be exposed.
Best Practices to Avoid Password Reuse
- Use Unique Passwords for Every Account:
- Each system, website, or service should have a different password.
- This ensures that if one password is stolen, other accounts remain safe.
- Use Password Managers:
- Password managers can generate and store strong, unique passwords for every account.
- Examples of password managers include LastPass, Bitwarden, 1Password.
- This removes the need to remember multiple complex passwords.
- Enable Multi-Factor Authentication (MFA):
- Even if a password is reused, MFA adds an extra layer of security.
- MFA can require a one-time code or fingerprint scan along with the password.
- Regularly Change Passwords on Critical Systems:
- Important accounts, like corporate email or financial systems, should have their passwords updated periodically.
Exam Tip:
- Remember: “Never reuse passwords across multiple sites or systems.”
- The CompTIA ITF+ exam may ask you to identify the risks of password reuse or suggest ways to prevent it.
Summary for Students:
| Topic | Key Point |
|---|---|
| Password Reuse | Using the same password on multiple accounts |
| Risk | One stolen password can compromise many accounts (credential stuffing) |
| Best Practices | Use unique passwords, password managers, enable MFA, update critical passwords regularly |
Quick IT Example:
- If an employee uses the same password for their work email and a social media account, and the social media account is hacked, the attacker could gain access to the work email system. This can expose company data, customer info, and internal communications.
