Digital Security

A new management software is installed in the office that allows access to more structured information, without having to go around to the right and left to verify the data of a case. It's a big step forward! It is a pity that it was developed again outside the company network and that it needs credentials different from those of the PC to use it. You have to set the new password to use it, how do you proceed?

When the new software asks you to create the password for your user, put the usual password you use for the PC, for gmail and for other services you use often, at least you are sure not to forget it!

When creating the new password, open your complex password management software, create a new one, and enter it being careful that it matches the one provided by the software ... you won't remember it by heart, but it will be there when you need it!

Another password? uhm ... you will use your secret technique that allows you to create long, complicated passwords, but that only you can understand / remember. Your coding is infallible, so far.

The password "unitedgo" will be great, and since it's the fourth time you've changed it, add a nice 4!

Check if your IT support manager has any recommendations on how to proceed, waiting for the application to be integrated with your local PC user, eliminating the need for another password!

1/8

You often use a specially modified password to always remember how to log in and not having to write your credentials around. Most of the password is the same, between the various sites, but some letters change to differentiate it according to the site. In the office you have to change your credentials and this time it seems that the email is rather threatening, they recommend not using passwords that you already use, how do you behave?

You decide that you will build a new, different password that you will remember well, but that has nothing to do with the one you use for you.

Use the password you remember, at least the base, and add the right sequence to remind you that this is the "working" one.

You decide that the time has come to move to a more structured system and look for a tool to preserve digital credentials (password manager), to which you can entrust with a single password, all the others, making them more complex.

Create credentials that do not use any of the previous passwords and since the email is so threatening, lengthen the password by turning it into a passphrase!

2/8

You are comfortably at your PC, check the company mail, at a certain point the following e-mail appears: "Subject: confirmation of user password change". The text is simple and seems to be that of the application you use often, the management software you use every day. There is a button to proceed... what do you do?

Follow the directions and click, you will be presented with a form to enter the current password, and put it new. Remember that you have to change it for a while, so provide...

Open the email, in fact it seems to remind you that you have to change the password and some time has passed since you last remembered, open the email, click and change the password.

Follow the link, change your password by adding the month and year number to the end of the one you remember well.

Open the email in full screen, you never know, and read well if the email is sent from within the company or from outside and check the sender by reading the email address, then only if you come back, click and see where the page sends you, checking also the web address that opens... in case of further suspicions call also IT support...

3/8

Phone call from a centralized service technician. The company "TISupport" S.P.A., which manages all our IT systems, calls to the landline underlining that the user password has almost expired and recommends changing it. To facilitate this, the technician proposes to change it over the phone, how do you proceed?

Indeed, three months have passed since the last time you remember having changed it, it is plausible that you are asked to change it, but yes, it is even more convenient to do it live... proceed with the technician.

Even if three months have passed since the last change, you still prefer to wait for the password change notification. Thank, greet and show you change your password when the next system report arrives.

Password, over the phone, does not convince you, even if in fact it seems an excellent initiative to make the user change not forget, and wait for the notification to arrive.

Ask anyone you speak to, a given identifier to recognize the technician on the phone. You also give yourself the number of his manager, to check if the initiative is actually this, it seems too convenient to be true!

4/8

How long do you think it is good practice to change your password?

Once a year as indicated by correct safety practices.

At least every six months.

At least every 3 months.

Every week.

When I consider it necessary, even before the recommended time.

5/8

A colleague calls you and tells you that he has lost his credentials to access the management program. What do you do to help him?

You give him your credentials, so he solves the problem quickly and he can work safely.

Recommend him to call IT support to reset his logins.

If the "recover password" button is available, you can use it, the email will arrive where you can change it. In that case you suggest him to enter a simple password like the daughter's name and date of birth.

If the "recover password" button is available, you can use it and change the password using a password generated with your password manager software.

6/8

While entering the new credentials, for password recovery, the management program asks you to choose answers that will be used for recovery. To the questions: What is the name by which they called you as a child? What's your favourite colour? As answers choose:

I insert Honey the name everyone used to call me and the Red. They all know it is so.

I insert answers that nobody knows and they are not recoverable, so that only I know them.

I insert qwerty in both fields, so much for password recovery only, I will never lose it.

II enter 1234 in the first field and 5678 in the second. it's easy to remember!

7/8

The management program has two-factor authentication. Do you know what it is?

It is an additional protection to the simple password, first enter the password and then a code generated by the token.

It's a system that only wastes time.

It is a system that authenticates twice on the management program, so if it is not used for a long time, access lasts twice as long.

8/8

Digital Security

for the Public Administration

Self-assessment quiz - Episode 2

Follow us on