Joseph Steinberg/Joseph Steinberg
By Editors
Newsweek Expert Forum
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
Today's consumers tend to face a near-constant barrage of advice about cybersecurity best practices, with media outlets worldwide offering all sorts of advice in the aftermath of headline-making data breaches.
Unfortunately, good intent does not keep people safe. And, for various reasons, much of the conventional cybersecurity advice that continues to be widely disseminated is not only off-base, it is "downright dangerous," according to cybersecurity expert Joseph Steinberg.
Read More on Experts
Periodic Password Changes Can Cause Problems Down the Line
Steinberg points to password guidance as an area in which much questionable cybersecurity advice has been given—to the point where people following such advice can sometimes not only fail to improve their own security, but can actually worsen it.
Steinberg points out, for example, that people are often told to change their passwords regularly (both in general and in response to data breaches), which he warns can lead to "boy who cried wolf" situations.
"When consumers are warned to change their passwords after a breach that does not actually impact them, for example, and they see that nothing happens to them if they do not follow such advice, they learn not to trust cybersecurity experts," Steinberg says. "Likewise, people who change their passwords but then hear from friends and colleagues who did not do the same—and who suffered no adverse consequences as a result of not making changes—learn to disregard the advice of cybersecurity experts."
Steinberg warns that when hackers do discover and exploit serious vulnerabilities, it's not hard to imagine what can happen if people have become apathetic to cybersecurity tips.
"People will, at that point, truly be at risk of their information being compromised," Steinberg says.
Moreover, according to Steinberg, the idea that people should regularly change their passwords has become so widespread that some organizations, including various universities and private companies, require that their user bases do so.
"While in theory, regularly changing passwords is beneficial, in the real world the opposite is true more often than not," Steinberg says. "Think about how many passwords the typical person has today. For example, if someone has 30 passwords—and most of us probably have more—and you tell them to change the passwords once a month, you are talking about 360 new passwords per year. There is no way that the typical person can remember that many passwords unless they use weak passwords or reuse passwords."
While Steinberg acknowledges that password managers can help address such problems by generating and changing strong passwords regularly, he cautions against over-relying on them.
"Your most sensitive passwords belong in your brain and only in your brain—remember, password managers have, at times, been compromised," Steinberg says. "If you want to have a backup of your most sensitive passwords, write them down on a piece of paper and put the paper in a safe deposit box somewhere. That doesn't mean you shouldn't use password managers. Just know that different passwords have different risk levels; if the compromise of a particular password would cause absolute chaos, make that password strong and keep it solely in your head."
Using A Random String of Letters, Numbers and Characters Can Be Counterproductive
Steinberg advises against using a random string of letters, numbers and characters in order to craft strong passwords (unless generated by a password manager). Although many people commonly advise using random letters, numbers and characters for passwords (and some websites even enforce such a requirement), in Steinberg's view, such a model is problematic, as it encourages the selection of passwords that are hard to remember and, therefore, disproportionately prone to reuse on other websites that enforce similar password requirements.
"In general, people should establish long passwords comprised of multiple, unrelated words and separate them either with numbers and/or characters," Steinberg says. "Ideally, at least one of the words should be in another language or should be an uncommonly used name or place. Such passwords are not only strong but also allow people to create mnemonics in their minds that help them remember their passwords."
On the flip side, Steinberg notes that sometimes, it is acceptable to both reuse passwords and to use weak passwords—for example, when registering for a site that requires establishing a free account in order to obtain access to some information.
"If you do not care if your account is breached and misused because there is no sensitive information associated with the account or accessible via the account, and the sole reason for creating the account is for the associated site to track you as you used it, then you don't have to waste your brainpower securing the account," he says. "However, you may wish to use an alternate email address when registering for such accounts."
Additionally, Steinberg advises people to use multi-factor authentication whenever it is practical to do so.
Data Backups Should Be a Balancing Act
Steinberg says there's a lot of off-base advice about data backups as well. He notes that many consumers don't adequately back up their data, and they are not prepared if their primary data source is destroyed.
"For example, there are many people who back up only to the so-called 'cloud,'" Steinberg says. "In many cases, if they update a file on a laptop, the backup copy in the cloud is updated immediately as well. While such real-time backups offer various benefits, if ransomware somehow successfully infects the user's computer, it can often easily destroy the backups along with the primary data repository. The same concern about ransomware propagating to backups also applies to situations in which people do not disconnect their computers from either physical devices or network drives after backing up to either one.
He points to another issue people can encounter with cloud storage companies: service.
"Cloud storage companies often juggle vast numbers of customers, meaning that they cannot provide individualized service unless a user is a paying, premium member," Steinberg says. "They can also change their terms of service or even limit or deny access to a user's account."
However, Steinberg stresses, that's not to say that people should avoid the cloud and opt for only encrypted, physical backups—for most people, physical backups alone aren't sufficient, as the backups can get destroyed or lost, or become otherwise inaccessible.
"When it comes to backups, the best strategy is to evaluate your risks and appropriately balance your use of cloud and physical storage in order to achieve the two models' respective benefits without suffering their respective drawbacks," Steinberg says.
Submit Correction
View Editorial & AI Guidelines