David Anderson is principal of David Anderson & Associates, a Philadelphia forensic accounting firm that provides a full range of fraud investigation, fraud deterrence, litigation support and expert witness testimony services in Philadelphia and the Delaware Valley.
The list of major corporations hit by a crippling data breach is legend; it seems no business is immune to computer hacking, large or small. One simple, oft-overlooked technique to help thwart these nefarious individuals is to create, and routinely update, secure access passwords.
“Having secure passwords is one of the most effective ways to protect your information and your identity,” said David Anderson, principal of David Anderson & Associates, a Philadelphia forensic accounting firm that provides a full range of fraud investigation and fraud deterrence programs in the Delaware Valley, “yet, the most common passwords people use are still ‘password,’ ‘123456’ and, courtesy of the Jackson Five, ‘abc123.’ These people are incredibly vulnerable to identity theft.”
Anderson, a Certified Fraud Examiner, said another common problem is that people use same password for everything – their home and work computers, personal and business emails, bank accounts, online purchases, etc. As a result, if just one password is stolen, the hacker can access all their accounts.
At the other end of the password security spectrum, he said, some companies and individuals create very complex and hard-to-guess passwords (for example, a$4QX3d%bGh87i9M).
“These passwords are obviously difficult to remember, especially if there is a requirement that they be changed every 60 to 120 days,” Anderson said. “So, what do people do? They write the password on a piece of paper and attach it to their monitor or desk where everyone can see it.”
What can you do to make sure your passwords are secure? Anderson, who recommends that every organization enact a comprehensive fraud deterrence program created by an experienced firm that provides forensic accounting services in Philadelphia and the Delaware Valley, suggests the following fraud deterrence measures to help protect your identity:
- Don’t use easily identifiable passwords such as those above, your birthday, your anniversary, your spouse’s name, etc. And don’t use the same password for everything.
- Make sure that your passwords are at least eight characters long (unless the system requires fewer).
- Include a mixture of capital and lowercase letters, numbers, and special symbols ($, %, &, etc., if permitted).
- Try to have some level of familiarity with the basis for each password so that it’s not too difficult to remember. For example, you could take the city of your birth (say, Chicago) and the year you started your business (say, 2007) to come up with the following password . . . Oga20Cih07C . . . This looks complicated, but it’s not. It’s Chicago spelled backwards in a group of three letters with the first letter capitalized, then the first two digits of the year, then repeat the pattern. After using this password a few times, it is easily memorized.
- For systems that require four-digit pins, select a four-letter word that you will remember and convert it to numbers using the telephone keypad. For example, you might use your father-in-law’s first name (Alex) to come up with 2539, or if you hail from Utah, you might want to use 8824. If you don’t use birthdays, anniversaries, street numbers or the last four digits of your phone number, it would be hard for someone to guess these converted numbers.
- Consider using a password manager. Your antivirus software may already contain a password manager, or there are several online password managers. You create a single strong password to log into the password manager, and it stores all your other passwords. As a result, you need to memorize only one strong password.
- Keep the written record of your password in a secure location. Don’t tape your password to your computer or your desk. And never share your passwords with other people.
Anderson recalled one fraud investigation he conducted that traced a data breach back to a busy company president who gave his email password to his executive assistant so that she could screen his email. When she was out sick, the company hired a temporary employee to take her place and gave her the password. The temporary employee shared the password and login information with her boyfriend, who stole confidential company information directly from the president’s emails.
If you aren’t sure that your passwords are strong enough to protect you and your company or if you aren’t confident that your employees are using secure passwords and keeping them in a safe place, it’s time to contact a Certified Fraud Examiner from an experienced firm that provides forensic accounting services in Philadelphia and the Delaware Valley to conduct a computer security analysis and recommend a comprehensive fraud deterrence program.
If you require forensic accounting services in Philadelphia and the Delaware Valley, please contact the Philadelphia forensic accounting firm of David Anderson & Associates by calling David Anderson at 267-207-3597 or emailing him at firstname.lastname@example.org.
About David Anderson & Associates
David Anderson & Associates is a Philadelphia forensic accounting firm that provides a full range of forensic accounting services in Philadelphia and the Delaware Valley. The experienced professionals at David Anderson & Associates provide forensic accounting, business valuation, fraud investigation, fraud deterrence, litigation support, economic damage analysis, business consulting and outsourced CFO services. Company principal David Anderson has more than 30 years of experience in financial and operational leadership positions and is a Certified Public Accountant, a Certified Fraud Examiner and a Certified Valuation Analyst.