Shoulder Surfing is especially prevalent in libraries, computer labs, airports, and other public areas.

Shoulder surfing is a technique where an attacker watches someone while they type in their passphrase.

Let’s now take a closer look at the modern password security policies and best practices that every organization should implement. Another best practice is to keep a copy of all private keys backed up centrally. It’s included here with permission from Qualys, Inc. Create A Strong, Long Passphrase. The private key must be examined. Strong passwords make it significantly more difficult for hackers to …


You cannot determine if a private key is passphrase protected by examining a public key.

NIST recently published its four-volume SP800-63b Digital Identity Guidelines.

Your credentials may be compromised via many methods. Best practice indicates that your private key(s) should remain secure and, well…private!

Among other things, it makes three important suggestions when it comes to passwords: Stop it with the annoying password complexity …

Use Best Practices for Web Application Design Designing your web applications with security in mind is just as important as configuring your server correctly.

This appendix contains SSL/TLS Deployment Best Practices, which is an SSL Labs publication I began to work on in 2012 and continue to maintain. Enforcing passphrase use depends on your environment and how centrally managed it is. Top 15 Principles of Password Management. The best one you can use for PGP Virtual Disk or PGP WDE is to have a user that is based on a public key, rather than a passphrase.
SSH: Best practices The comments around the last OpenSSH issue ( CVE 2016-0777 , you must read excellent Qualys’ analysis if you’re interested with the details), I noticed that many people were not aware of some basic features of OpenSSH. Changes in Password Best Practices.

1. Obtaining a comprehensive understanding of the SSL/TLS and …

To you, the end user, this is almost the same. You type the passphrase of a public key pair rather than a passphrase on the disk. Get quick, easy access to all Canadian Centre for Cyber Security services and information.