We’ve discussed password liabilities before:  Consider that many people use the same password (and often User ID) for multiple accounts.  This can include online bank credentials, work accounts, social networking sites, other critical sites such as ebay and PayPal…

A breaching entity can hack one account, gain credentials, and then spin them through all other associated user accounts they identify.

Of course, password liabilities also include easy-to-guess things, which are subsequently hacked – either by manual human activity, or password-breaking softwares that simply tumble random words/characters, through authentication mechanisms.  This morning, while having my auto serviced, I tried “password” in trying to gain access to a couple wireless networks in the vicinity – alas, no luck – but worth a try.  Consider:  About 5 years ago, Slovak hackers gained access to Slovakia’s National Security Bureau (NBU).  The NBU maintains a huge body of classified information, which is supposed to enjoy strong security.  However, the hack and breach wasn’t particularly sophisticated:  The respective login ID and password was nbu/nbu123.  

Might want to put a little thought into your organization’s passwords and their associated strength:  Set a minimum amount of characters, and consider making some measure of required special characters (!@%, etc.).  Also, see the four basic requirements at the bottom of this article for maintaining a solid password security posture.

Here are PC Magazine’s worst passwords of 2011:

  1.  password

  2.  123456

  3.  12345678

  4.  qwerty

  5.  abc123

  6.  monkey

  7.  1234567

  8.  letmein

  9.  trustno1

10.  dragon

11.  baseball

12.  111111

13.  iloveyou

14.  master

15.  sunshine

16.  ashley

17.  bailey

18.  passw0rd

19.  shadow

20.  123123

21.  654321

22.  superman

23.  qazwsx

24.  michael

25.  football

Finally, remember to employ four basic, yet critical, practices for maintaining secure passwords:

1)      Use unique passwords for each account.

2)      Change your passwords on a schedule.  How frequently is up to you, but anything from monthly to semi-annually.

3)      Don’t share your passwords.

4)      Avoid common passwords.

NP:  Hi Lili, Hi Lo, Bill Evans, jazz24.org

Just kidding – it’s only Part 2.  (Please see first article, just below this one for reference).

Sony has said that this information has been compromised:  User name; address; country; e-mail address; birthdate; PlayStation Network/Qriocity password and login; and handle/PSN online ID.

Wow – that’s quite a bit.  But it gets worse, and I always hate the “maybe(s), might have been(s)…” etc. – there may have been breach of user billing address, purchase history, and various password security answers.  Ouch.

I had to laugh at some counsel from the Washington Post Business with Bloomberg section (which I saw online – I no longer reside in DC, but have many fond memories…):

This is certainly a big data breach and spells a lot of trouble for Sony’s image, but there’s no need for consumers to panic.  Just deal with it the same you deal with any data breach…

Yah.  No big deal…  handle it like that last breach you suffered through – and, hopefully the next one won’t be any bigger a deal than this one either.

Now, I don’t advocate panicking – I’m all about serious, straight-ahead tackling of problems – establishing empirical measures and solutions, for meritorious outcomes and protections.

But frankly, a rather casual attitude seems to exist here – paired with some good advice, make no mistake – I like it the advice.  But, in the realm of risk, unmanaged possibilities become probabilities. 

And here, Sony had tipped into the realm of probability:  Given the outcome, there can be no argument.  Let’s understand this fully for anyone and their position in today’s Weave: 

1.      Sony was in the realm of risk – we’re all there, particularly if we have any kind of online presence and business.  Risk – assumed and beyond:  Acknowledged.

2.      Sony entered a zone of unmanaged possibilities; again, given the outcome, there can be no argument.  The possibilities were engendered by someone who was not surveying the environment adequately, nor putting in place the prudent, forward, security posture and measures necessary.  (Note:  This is not fault-finding; the “someone” or “someones” may not have been able to survey adequately; may have been inhibited by budget; lack of training; or maybe the appropriate “someone,” department, security posture, etc., was simply missing in action at Sony).

3.      As usual, the unmanaged possibility manifested as a probability – and – the probable happened, as it always must – simple odds favor the probable, to the point that an unmanaged probable will always manifest.

Odds favor the probable, and left unattended, the probable will always manifest.

Thus, in the realm of risk, unmanaged possibilities become probabilities.

Survey your domains.

NP:  Yardbird Suite, Charlie Parker, www.Jazz24.org – followed by Keep on Gwine, Stanton Moore…  all I can say is… wow – each over 13 minutes of fine, fine, fine jazz…