Passwords, Accounts & Workplace Security

Creating Strong Passwords

The single most important factor in password strength is length. A long password made of simple words is much harder to crack than a short password full of symbols.

The passphrase method

Instead of a single complicated word, use a passphrase: four or more random words strung together. Pick words that create a picture in your mind so you can remember them.

The short password can be guessed by automated tools in minutes. The passphrase is 26 characters and would take centuries to crack, but you can picture a purple fish dancing on a Tuesday.

How to make a good passphrase

• Pick 4+ random words that are not related to each other or to you. Avoid your name, birthday, pet, or favorite team.
• Make it memorable. Imagine a silly picture: "green-hammock-sings-quietly" is a green hammock singing quietly.
• Use separators like dashes, periods, or spaces between words.
• Aim for 16+ characters. Four average words easily reach 20+.

Protecting Your Accounts

Never share your password

Your password is yours alone. No one at this company will ever need it, including IT, your manager, or HR. If someone asks for your password for any reason, that is a red flag.

Do not reuse passwords between work accounts

Use a different password for every work system you log into. If you have a login for the HR portal, your email, and any other work application, each one should have its own unique password.

If one account is compromised and you used the same password on your other work accounts, the attacker now has access to all of them.

If you think your password is compromised

• Change it immediately. Do not wait.
• Tell your manager or IT. They can check for suspicious activity on your account.
• The best protection is never reusing passwords. But if you did use the same password on other accounts, change all of them right away. Start with your most sensitive accounts first.

Physical Security

Shoulder surfing

Someone watching over your shoulder as you type your password or view sensitive information is called shoulder surfing. This can happen in the office, at a job site, or anywhere you use a device.

Lock your screen when you walk away

Always lock your screen when stepping away, even for a few minutes. On Windows, press Windows key + L to lock instantly. It takes one second and prevents anyone from accessing your accounts.

Do not write passwords down

Avoid writing passwords on sticky notes, under your keyboard, or anywhere visible at your workspace. If you need help remembering passwords, the passphrase method makes them easy to remember.

Pretexting & Social Engineering

Pretexting is when an attacker invents a believable scenario to manipulate you into giving up information, access, or taking an action you normally would not. Unlike phishing emails, pretexting can happen by phone, in person, or through any channel.

How pretexting targets you

Attackers create convincing stories designed to make you act quickly without thinking. These scenarios are crafted to feel urgent, helpful, or authoritative so you lower your guard.

Common pretexting scenarios

• Fake IT support. Someone calls or emails claiming to be IT and needs your password or remote access to "fix" an issue.
• Urgent requests from leadership. An email or call claiming to be from your boss asking you to buy gift cards, wire money, or bypass a normal process.
• Vendor impersonation. A call or email from someone pretending to be a vendor asking to change payment details or requesting sensitive information.
• Fake account alerts. A text or email saying your direct deposit failed or your benefits enrollment is expiring, with a link to "fix" it. The link leads to a fake login page that steals your credentials.

Module Summary

Here is a quick recap of what you learned in this module. Keep these points in mind as you take the quiz.

Strong passwords

Length is the most important factor. Use passphrases of 4+ random words (16+ characters). Never use your name, birthday, or company name as a password.

Account protection

Never share your password with anyone. Use a unique password for every work system. If you think a password is compromised, change it immediately and notify IT.

Physical security

Be aware of your surroundings. Lock your screen when you step away (Windows + L). Watch for shoulder surfing. Do not write passwords down.

Pretexting & social engineering

Verify before you act. No one at this company will ever ask for your password. When someone creates urgency or pressures you to skip a normal process, that is the red flag. Slow down and verify through a known channel.