Learning Objectives
- Understand why strong passwords matter
- Learn how to create secure passwords
- Recognize common password-related threats
- Use password managers effectively
Why Passwords Matter
Your password is the first line of defense protecting your accounts. Weak passwords can lead to account compromise, data breaches, and identity theft.
⚠️ Never do this:
• Don't use "password123" or "qwerty" as your password
• Don't reuse the same password across multiple accounts
• Don't share your password with anyone, even IT support
• Don't write passwords on sticky notes or unencrypted files
• Don't use "password123" or "qwerty" as your password
• Don't reuse the same password across multiple accounts
• Don't share your password with anyone, even IT support
• Don't write passwords on sticky notes or unencrypted files
Creating Strong Passwords
A strong password should be:
- At least 12 characters long - Longer is better
- Mix of uppercase, lowercase, numbers, symbols - e.g., T!g3r$Run2026
- Not based on personal info - No birthdays, pet names, etc.
- Unique for each account - Different password for email, banking, work
✓ Pro Tip: Use passphrases
Instead of "P@ssw0rd!", try "Coffee-Bicycle-Mountain-2026!"
Easier to remember, harder to crack.
Instead of "P@ssw0rd!", try "Coffee-Bicycle-Mountain-2026!"
Easier to remember, harder to crack.
Bad Password Examples (DO NOT USE)
❌ password
❌ 123456
❌ admin
❌ letmein
❌ companyname2026
❌ 123456
❌ admin
❌ letmein
❌ companyname2026
Good Password Examples
✓ Tr0p!cal$Sunset#47
✓ Blue-Anchor-Ship-91!
✓ 7$Moonlight&Ocean*
✓ Quantum!Forest@2026
✓ Blue-Anchor-Ship-91!
✓ 7$Moonlight&Ocean*
✓ Quantum!Forest@2026
Using Password Managers
We recommend using a password manager like 1Password, LastPass, or Bitwarden. These tools:
- Generate strong, random passwords for you
- Store passwords securely with encryption
- Auto-fill credentials on websites
- Sync across all your devices
Multi-Factor Authentication (MFA)
Even with a strong password, enable MFA whenever possible. This adds a second layer of security—typically a code from your phone or an authentication app.
Company Policy: All employees must enable MFA on their work email, Slack, GitHub, and AWS accounts by end of this month.
Recognizing Phishing Attempts
Attackers may try to trick you into revealing your password through fake emails or websites. Red flags:
- Urgent requests for password resets
- Links to login pages that look slightly off (micr0soft.com vs microsoft.com)
- Emails asking you to "verify your account" or "confirm your SSN"
- Unexpected attachments or links from unknown senders
What to Do If Compromised
If you suspect your password has been compromised:
- Change your password immediately
- Check for unauthorized access or changes to your account
- Report the incident to IT Security (security@company.example)
- Review other accounts using the same password and change those too