- Izinguquko zephasiwedi eziphoqelelwe ngezikhathi ezithile zikhuthaza okhiye ababuthakathaka namaphethini angabikezelwa, okunciphisa ukuphepha kwangempela.
- Amaphasiwedi kufanele abe made, ahlukile, futhi aqine, futhi ashintshwe kuphela uma kukhona ukusola noma ubufakazi bokuvumelana.
- Ukuqinisekiswa kwezinto eziningi kanye nabaphathi bephasiwedi manje sebengamathuluzi ayisihluthulelo okuvikela ama-akhawunti ekuvuvukeni nasekuhlaselweni.
- Ikusasa lisezinhlelweni ezifana nama-passkey, anciphisa ukuncika kumaphasiwedi avamile kanye nezinkinga zawo zokweba nokusebenzisa kabusha.
Sekuyiminyaka sizwa ukuthi into enesibopho okufanele siyenze ukushintsha amaphasiwedi ethu njalo , cishe njengokufaka intela yethu: kwakuyimpoqo. Kodwa eminyakeni yamuva nje, izinhlangano eziphambili zokuphepha kwe-inthanethi, njenge- US National Institute of Standards and Technology (NIST) , zibuyekeze ngokuphelele lesi sincomo futhi zafinyelela esiphethweni esimangalisayo: ukuphoqa ukushintsha iphasiwedi njalo kuvame ukwenza kube kubi kakhulu ukuphepha kunokukuthuthukisa.
Lolu shintsho endleleni yokusebenza lusekelwa idatha evela ekuphulweni okukhulu kweziqinisekiso, izifundo zokuziphatha komsebenzisi, kanye nokuhlangenwe nakho okusebenzayo kwezinkampani namanyuvesi. Namuhla, isincomo esivamile ukugcina amaphasiwedi aqinile, amade, futhi ahlukile , ukuwashintsha kuphela uma kukhona ukusola noma ubufakazi bokuvumelana, kanye nokuthembela kumathuluzi anjengokuqinisekiswa kwezinto eziningi (i-MFA) kanye nabaphathi bamaphasiwedi ukuze kugwenywe ukukhungatheka kokukhumbula amaphasiwedi angenakwenzeka.
I-NIST, ebeka amazinga obuchwepheshe ezinkampanini zikahulumeni wase-US futhi esebenza njengesilinganiso sezinkampani emhlabeni wonke, icacisile kumhlahlandlela wayo i-SP 800-63-4 ukuthi abasebenzisi akufanele badingeke ukuthi bavuselele amaphasiwedi abo njalo uma kungekho bufakazi bokwephulwa kokuphepha. Lokhu kuwukushintsha okukhulu kusuka kunqubomgomo yendabuko "yokushintsha njalo ezinsukwini ezingama-30/60/90".
Uhlaka lomphakathi lwalezi ziqondiso luchaza ukuthi, uma iphasiwedi ikhethwe kahle (ide, ingahleliwe futhi ihlukile), ukuphoqelela izinguquko njalo ngenyanga eyodwa noma ezintathu kunciphisa ukuphepha : umthwalo wokukhumbula amaphasiwedi amasha ushukumisela abantu ukuba bawenze lula, bawasebenzise kabusha noma basebenzise amaphethini angabikezelwa, okuyilokho kanye abahlaseli abasizakala ngakho.
Izincomo zamanje zithi abahlinzeki bezinsizakalo kanye nabaqinisekisi bobunikazi akufanele babeke ukuphelelwa yisikhathi kwephasiwedi ngezikhathi ezithile . Esikhundleni salokho, banesibopho sokuphoqelela ushintsho olusheshayo lapho kunezimpawu zokuthi umqinisekisi usengcupheni, isibonelo, ngemuva kokwephulwa kwedatha, ukufinyelela okusolisayo, noma ukuba khona kwephasiwedi kudathabheyisi evuzayo.
Ngaphezu kwalokho, i-NIST ibuza ezinye izidingo zendabuko, njengemithetho eqinile yokwakheka (ephoqa inhlanganisela yezinhlamvu ezinkulu, izinombolo, kanye nezimpawu) noma imibuzo yokuphepha edumile efana nokuthi "igama lesilwane sakho sokuqala." Ubufakazi bubonisa ukuthi le mithetho ibangela abasebenzisi ukuthi baziphathe ngezindlela ezibikezelwa kakhulu, bakhiqize amaphasiwedi afana ne -Password2023, Password2024, noma i-Password1!, okuyisipho kubahlaseli.
Ukuhlaziywa kwezizindalwazi ezinkulu zamaphasiwedi abiwe kwembula ukuthi inzuzo yangempela yale mithetho yakudala incane kakhulu kunalokho okwakucatshangwa ngaphambili , kuyilapho umthelela omubi ekusetshenzisweni nasekukhumbulekeni umkhulu kakhulu. Ngamafuphi: abantu bagcina befuna izinqamuleli ezilula, futhi lezo zinqamuleli cishe ziyafana njalo.
Indlela amaphasiwedi akho asengozini ngayo namuhla
Kungakhathaliseki ukuthi ushintsha iphasiwedi yakho njalo ezinyangeni ezintathu noma cha, ama-akhawunti akho asengozini ngenxa yendlela izigebengu ze-inthanethi eziyithola ngayo . Ukwebiwa akuvamile ukwenzeka ngokuqagela okuyisimangaliso iphasiwedi yakho, kodwa ngezindlela eziningana eziqondile kakhulu nezaziwayo.
Enye yezindlela ezivame kakhulu ukuvuza kwedatha okukhulu okuvela kumasevisi aku-inthanethi. Amanethiwekhi omphakathi, amaforamu, amapulatifomu okudlala, amasayithi e-commerce, kanye nabahlinzeki bamafu babhekana nokwephulwa kwezokuphepha okuveza izigidi zezinhlanganisela zamagama abasebenzisi namaphasiwedi, ngezinye izikhathi ngisho nokungabhalwanga noma ngama-algorithms aphukile. Lawa ma-database agcina ethengiswa kabusha kumaforamu okugenca kanye newebhu emnyama.
Esinye isizathu esivamile ukuthi iphasiwedi yakho ibuthakathaka noma ivame kakhulu . Uhlu lwamaphasiwedi asetshenziswa kakhulu emazweni afana neSpain lubonisa amabi kakhulu afana ne-"admin", "123456", "000000", "password", noma amagama namadolobha asobala afana ne-"carl0s" noma "barcelona". Lolu hlobo lokuhlanganiswa lungaqhekeka esikhathini esingaphansi komzuzwana ngamathuluzi e-brute-force azenzakalelayo.
Kukhona futhi ukuhlaselwa kwe-phishing kanye nobunjiniyela bezenhlalo , lapho umhlaseli ekukhohlisa ukuthi ufake iphasiwedi yakho kuwebhusayithi mbumbulu elingisa ibhange lakho, i-imeyili, noma isayithi lezokuxhumana. Ngezinye izikhathi lokhu kuhlanganiswa ne-malware ye-keylogger, eqopha ukuchofoza okhiye ukuze ithwebule noma yiziphi iziqinisekiso ozifakile.
Okokugcina, akumelwe sikhohlwe ubuthakathaka besofthiwe nehadiwe . Izinhlelo eziphelelwe yisikhathi, ama-router ane-firmware endala, izinhlelo zokusebenza ezinamaphutha okuphepha—konke lokhu kungavumela umuntu wesithathu ukuthi afinyelele amaphasiwedi akho agciniwe noma awashintshe futhi avimbele ukufinyelela kwakho okusemthethweni. Yingakho ochwepheshe bephikelela ekugcineni izinhlelo namadivayisi kusesikhathini.
Kungani ukushintsha "uma kwenzeka" kungaba umqondo omubi
Kulesi simo, abasebenzisi abaningi bacabanga ukuthi ukushintsha iphasiwedi yabo njalo kuyindlela yokuphepha evamile. Kodwa-ke, i-NIST kanye nezifundo ezivela emanyuvesi afana neCarnegie Mellon ziyavuma ukuthi ukushintsha iphasiwedi njalo nokungenangqondo kwandisa ingozi yemisebenzi enonya.
Uma uhlelo lukuphoqa ukuthi ushintshe amaphasiwedi akho njalo, abantu abaningi bayayeka ukucabanga ngakho kakhulu bese besebenzisa izinguquko ezincane nezincane : ukwengeza noma ukwandisa inombolo ekugcineni, ukushintsha unyaka, ukushintshanisa uphawu olusobala... kanye namaphethini abahlaseli abanawo kakade ezichazamazwini zabo.
Ngaphezu kwalokho, ukuphazamiseka kwalezi zinguquko kushukumisela abantu ukuthi basebenzise amaphasiwedi amafushane futhi alula kakhulu , noma basebenzise kabusha iphasiwedi efanayo kumasevisi ahlukene anezinguquko ezincane. Uma umhlaseli ephula enye yala ma-akhawunti, uzoba nezinkomba ezicacile zabanye, okwandisa umonakalo ongaba khona.
Ochwepheshe abaningi bakhomba ukuthi uma izinkampani bezinikela ngesikhathi nemali echithwa ekuphoqeleleni izinguquko zephasiwedi njalo ngekota ekuqeqesheni abasebenzisi ukuthi bangawakha kanjani amaphasiwedi aqinile futhi ahlukile , kanye nokufaka abaphathi bamaphasiwedi kanye nokuqinisekiswa kwezinyathelo ezimbili, intuthuko yangempela ekuphepheni ingaba nkulu kakhulu.
Ngisho nezinkampani zokuphepha ziyavuma ukuthi, ngaphandle kobufakazi bokwephulwa kwedatha , ukushintsha iphasiwedi yakho njalo akuyenzi ivikeleke kakhulu. Eqinisweni, kungadala umuzwa wokuphepha ongamanga kuyilapho ezinye izibuthakathaka ezinkulu ziqhubeka, njengokusebenzisa kabusha iphasiwedi efanayo kumasayithi amaningi noma ukungavumeli i-MFA isebenze.
Kufanele ushintshe nini iphasiwedi yakho ngaphandle kokungabaza?
Nakuba ukujikeleziswa kwephasiwedi okuphoqelelwe kungaseyona indlela enhle, lokho akusho ukuthi kufanele unamathele kuphasiwedi efanayo kungakhathaliseki ukuthi kwenzekani. Kunezimo lapho ukuyishintsha ngokushesha kubalulekile khona ukuze kuncishiswe ingozi.
Uma inkampani lapho une-akhawunti imemezela ukwephulwa kwedatha , into ehlakaniphile okufanele uyenze ukuvuselela iphasiwedi yakho yaleyo nsizakalo ngokushesha okukhulu, kanye nanoma yimaphi amanye ama-akhawunti lapho ungase uyisebenzise khona kabusha (uma ukwenzile lokho). Ngezinye izikhathi lokhu kwephulwa kuthatha amasonto ukubikwa, ngakho-ke amathuluzi okuqapha iwebhu emnyama noma izinsizakalo ezifana ne-"Have I Been Pwned" zingakusiza ukuthi uthole ngokushesha uma ikheli lakho le-imeyili livela ohlwini oluvuzayo.
Esinye isibonakaliso esicacile sesixwayiso ukuzama ukungena ngemvume noma ukushintsha iphasiwedi okungacelwanga . Uma uthola ama-imeyili asemthethweni abuza ukuthi "Ucele ukusetha kabusha iphasiwedi?" noma izaziso zokungena ngemvume ezivela ezindaweni noma kumadivayisi angajwayelekile, kufanele ushintshe iphasiwedi yakho ngokushesha ngokungena ngemvume kusevisi ngokwakho (ngaphandle kokuchofoza izixhumanisi ezisolisayo) bese uvula i-MFA uma ungakayifaki.
Uma usola ukuthi idivayisi yakho itheleleke nge-malware , kufanele futhi ushintshe amaphasiwedi akho, kodwa kuphela ngemva kokuhlanza idivayisi yakho. Ukushintsha amaphasiwedi akusizi ngalutho uma umhlaseli esakwazi ukubona konke okuthayiphayo. Uma uhlelo seluhlanziwe, kufanele ubuyekeze iziqinisekiso zezinsizakalo ezibalulekile (i-imeyili, ibhange, izinkundla zokuxhumana, isitoreji samafu, njll.).
Uma enye yama-akhawunti akho igetshengiwe ngokusobala ( kubonakala sengathi awukayithumeli, okuthengiwe ongakakwenzi, izinguquko zephrofayela ezingajwayelekile), wonke ama-akhawunti abelana ngephasiwedi efanayo noma ukuhlukahluka okufanayo kufanele abhekwe njengasengozini, futhi amaphasiwedi awo kufanele ashintshwe ngokushesha.
Ezindaweni zezinkampani, kuma-akhawunti abaphathi noma ezinhlelweni ezibucayi kakhulu, izinhlangano eziningi zisakhetha ukushintshanisa iziqinisekiso eziyimfihlo ngezikhathi ezithile, kodwa zenza kanjalo ngendlela ezenzakalelayo nangokukhiqiza amaphasiwedi aqinile angahleliwe, ukuze zigweme amaphutha abantu ahlobene nokushintsha ngesandla.
Iyini iphasiwedi evikelekile namuhla (nokuthi yini engeyona)
Iphasiwedi imane nje iyiqoqo lezinhlamvu ezikunikeza ukufinyelela kolwazi oluyimfihlo noma izinsiza ezibalulekile: i-imeyili, imithombo yezokuxhumana, ibhange eliku-inthanethi, iphaneli yokulawula yewebhusayithi yakho, i-VPN yenkampani yakho, amadivayisi eselula, njll. Iqiniso lokuthi yiyona kuphela isithiyo phakathi kwempilo yakho yedijithali nomhlaseli kufanele libe yisizathu esanele sokuyithatha ngokungathi sína.
Ochwepheshe bebelokhu bethi iphasiwedi enhle kufanele ibe yinde, iyinkimbinkimbi, futhi ihlukile . Ngokwesiko, lokhu kwakusho okungenani izinhlamvu eziyisishiyagalombili, ukuhlanganisa izinhlamvu ezinkulu nezincane, izinombolo, nezimpawu, nokugwema amagama esichazamazwi noma ulwazi lomuntu siqu (izinsuku, amagama, amapuleti elayisensi, njll.).
Iziqondiso zakamuva ze-NIST zigcizelela kakhulu ubude: zincoma ukuthi kudingeke okungenani izinhlamvu ezingu-8 , kodwa zikubona kuyinto efiselekayo ukuphakamisa ibha ibe ngu-15 noma ngaphezulu , okuvumela izinhlamvu ezingafika ku-64. Uma umusho umude, kuba nzima ukuwusebenzisa ngokuhlasela okuzenzakalelayo, uma nje ungewona umusho obikezelwayo.
Isu elihle kubantu ukusebenzisa amagama ayimfihlo : ukulandelana kwamagama angahleliwe axutshwe nezimpawu nezinhlamvu ezinkulu, okulula ukuthi uzikhumbule kodwa kunzima kakhulu ukuthi ikhompyutha iwaqhekeze. Izibonelo ezifana ne-"Mars-Whale-Near4-Melted" noma i-"Minute.Truck.Where2.Attempt" zinikeza i-entropy ephezulu kakhulu ngaphandle kokuthembela kumaphethini ajwayelekile.
Okufanele ukugweme amaphasiwedi avela unyaka nonyaka phakathi kwasetshenziswa kakhulu: "123456", "password", "qwerty", "111111", "admin" , inhlanganisela yekhibhodi esobala, amagama ahlukene, ukulandelana kwezinombolo noma okhiye ngokusekelwe kulwazi umuntu angalukhipha ezinkundleni zokuxhumana (igama lomlingani, iqembu lebhola, usuku lokuzalwa...).
Okubaluleke ngokulinganayo ukuthi isevisi ngayinye isebenzisa iphasiwedi ehlukile . Ukusebenzisa kabusha iphasiwedi efanayo kuma-imeyili, ezinkundleni zokuxhumana, ebhange, nasekuthengeni kufana nokusebenzisa ukhiye ofanayo wendlu yakho, imoto, kanye nesisefo, bese ushiya ikhophi kumata womnyango. Uma enye yalawo mawebhusayithi iphulwa, umhlaseli angazama nje leyo nhlanganisela kuzo zonke ezinye izinsizakalo ezidumile.
Ukuqinisekiswa kwezinto eziningi, abaphathi bamaphasiwedi nama-password
Esinye isici esiyinhloko salolu shintsho lwendlela yokushintshashintsha indlela yokushintsha ...
I-MFA ingeza ubufakazi besibili bokuthi ungubani, okungaba yinto oyaziyo (iphasiwedi yakho), into onayo (ifoni ephathekayo, ithokheni ebonakalayo, uhlelo lokusebenza lwekhodi), noma into oyiyo (iminwe, ubuso, iris). Ngale ndlela, noma ngabe othile weba iphasiwedi yakho, kuzoba nzima kakhulu ngaye ukuthola ukufinyelela ngaphandle kwalesi sici sesibili.
Ukunika amandla i-MFA ye-imeyili, imithombo yezokuxhumana, amabhange aku-inthanethi, izinsizakalo zamafu, noma ukufinyelela emsebenzini okude kuvimbela ukuhlaselwa okuningi okuzenzakalelayo okuncike kumaphasiwedi abiwe noma abuthakathaka. Ngisho noma iphasiwedi yakho ibonakala ekuphulweni kwedatha, umhlaseli uzobhekana nesithiyo esengeziwe, okunzima ukusinqoba.
Ukuze kuxazululwe inkinga yokukhumbula amaphasiwedi amaningi amade nahlukile, ochwepheshe batusa ukusebenzisa umphathi wephasiwedi . Lawa mathuluzi akhiqiza amaphasiwedi ayinkimbinkimbi kakhulu, angahleliwe, awagcine efihliwe endaweni evikelekile, futhi awagcwalisele wena uma ungena ngemvume. Okudingeka ukwenze nje ukuvikela iphasiwedi eyodwa eqinile futhi, uma kungenzeka, unike amandla i-MFA (Multi-Factor Authentication).
Umphathi wephasiwedi omuhle uvimbela imikhuba eyingozi njengokubhala amaphasiwedi ephepheni, kumaspredishithi angabethelwe, noma kumanothi efonini yakho, noma ukuvumela isiphequluli sakho ukuthi siwagcine. Kukukhuthaza nokuthi usebenzise amaphasiwedi amade kakhulu kunalawo ongawakhumbula wedwa, okuthuthukisa ukumelana kwakho nokuhlaselwa.
Okwamanje, ama-passkey, noma okhiye bokufinyelela , aya ngokuya ethandwa kakhulu. Lezi zindlela zesimanje zokusebenzisa amaphasiwedi endabuko zisekelwe ku-cryptography yokhiye womphakathi. Ama-passkey agcinwa kudivayisi noma kumphathi ohambisanayo futhi avumela abasebenzisi ukuthi bangene ngemvume besebenzisa iminwe, ukuqashelwa kobuso, noma i-PIN yendawo, ngaphandle kokuthumela iphasiwedi engasetshenziswa kabusha kuseva.
Iziqhwaga ezifana ne-Google, i-Apple, i-Microsoft, i-Amazon, i-PayPal, ne-GitHub sezivele zisekela ama-passkey, futhi amawebhusayithi nezinhlelo zokusebenza ezingaphezu kwekhulu ziyajoyina. Nakuba amaphasiwedi engeke anyamalale ngobusuku obubodwa, ikusasa likhomba ezinhlelweni ezingenawo amaphasiwedi ezizonciphisa izinkinga eziningi zamanje zokweba nokusetshenziswa kabusha.
Imikhuba emihle yokuphepha kwephasiwedi empilweni yansuku zonke
Ngale kwempikiswano mayelana nokuphelelwa yisikhathi, umgomo wakho kufanele kube ukunciphisa indawo yokuhlasela ekhona ngamaphasiwedi akho. Lokhu kuhilela ukuhlanganisa imikhuba eminingana elula elula ukuyisebenzisa uma yenziwe ngokucophelela.
Okokuqala, zibophezele ekungaphindeni usebenzise iphasiwedi efanayo kuma-akhawunti angaphezu kweyodwa , ikakhulukazi ezinsizeni ezibalulekile njenge-imeyili, ibhange, izitolo eziku-inthanethi ezinamakhadi esikweletu agciniwe, nama-akhawunti omsebenzi. Uma usuvele uwasebenzisa kabusha, kwenze kube yinto eza kuqala ukushintsha lawo maphasiwedi bese uwagcina ehlukene usebenzisa umphathi wephasiwedi.
Uma ubuyekeza iphasiwedi, gwema "ukukopela" ngokushintsha uhlamvu olulodwa kuphela (ukwengeza inombolo ekugcineni, ukufaka uphawu olufanayo esikhundleni sohlamvu, njll.). Izigebengu ze-inthanethi ziyawazi kahle la maphethini, futhi amathuluzi okuhlasela awafaka ngokuzenzakalelayo.
Cabanga ukusebenzisa amagama amade okungena kuma-akhawunti ofuna ukuwakhumbula (isibonelo, iphasiwedi yakho eyinhloko yomphathi we-akhawunti yakho). Hlanganisa amagama amaningana abonakala engahlobene, faka izinhlamvu ezinkulu ezindaweni ezingacacile, bese wengeza inombolo noma uphawu phakathi kwawo ukuze wandise ubunzima.
Uma ungadingi ukukhumbula iphasiwedi yakho ngoba usebenzisa umphathi wephasiwedi, sebenzisa ama-generator ayo ephasiwedi kanye ne-password phrase . Lawa adala ngokuzenzakalelayo izintambo ezingahleliwe ezifana ne-"3>ZfrT61(9#X;?Kdk4FQ" noma imisho eyinkimbinkimbi bese uyigcina endaweni yakho yokugcina. Into ebalulekile lapha akusikho nje ukukwazi ukuyiphinda ngekhanda kodwa ukuqinisekisa ukuthi akekho omunye umuntu ongakwazi ukuyiqagela.
Ezingeni elisebenzayo, gwema ngazo zonke izindleko ukugcina amaphasiwedi ngombhalo ocacile kukhompyutha yakho noma kudivayisi yeselula, kungaba kumanothi, amadokhumenti angadingekile, izithombe zamanothi anamathelayo, noma ama-imeyili owathumela kuwe. Noma iyiphi i-malware, ukwebiwa kwamadivayisi, noma ukufinyelela ngokomzimba okungagunyaziwe kungaguqula konke lokho kube imephu yengcebo yomhlaseli.
Okokugcina, jwayela ukuhlola njalo ukuthi ama-akhawunti akho avele yini ekwephulweni kwedatha okwaziwayo, usebenzisa izinsizakalo zokuthola ukwephulwa noma izici zokuphepha zomphathi wakho wephasiwedi noma isiphequluli. Uma uthola ukuthi iphasiwedi iveziwe, kufanele uyishintshe ngaphandle kokungabaza.
Ezweni lapho ukwephulwa kwedatha kubalelwa ezigidigidini kanye nezinye izindlela ezifana ne-MFA nama-passkey avelayo, isu lokuwina akusekho mayelana nokushintsha amaphasiwedi njalo, kodwa mayelana nokwakha uhlelo lokufinyelela oluqinile nolulawulekayo : amaphasiwedi amade nahlukile, ukuqinisekiswa kwezinto eziningi, amathuluzi enza kube lula ukuphatha, kanye nokunaka izimpawu zokuyekethisa kwangempela. Uma ulungisa imikhuba yakho ngale ndlela, ama-akhawunti akho azovikeleka kangcono ngisho noma ungakhumbuli isikhathi sokugcina owashintsha ngaso iphasiwedi yakho "ngekhalenda."
