◇ OpenCyber Academy
Technologist · Chapter 13 · English

Chapter 13 — Passwords and secrets

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 13 — Passwords and secrets

Lesson map

Lesson 13 published. Map, example, EX037.

flowchart TD
  N0["Learning outcomes"]
  N1["13.1 Password rules"]
  N2["13.2 Password managers"]
  N3["13.3 Secrets in scripts"]
  N4["13.4 Secrets in documents"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX037"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["13.1 Password rules"]
  N2["13.2 Password managers"]
  N3["13.3 Secrets in scripts"]
  N4["13.4 Secrets in documents"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX037"]

[Learning outcomes]
    |
    v
[13.1 Password rules]
    |
    v
[13.2 Password managers]
    |
    v
[13.3 Secrets in scripts]
    |
    v
[13.4 Secrets in documents]
    |
    v
[Worked example] --> [Exercise EX037]

Learning outcomes

You will (1) set practical password rules; (2) manage shared secrets with a password manager; (3) remove secrets from scripts and documents.

13.1 Password rules

Riverbend's old rules forced password changes every month, leading staff to add a number to the same word each time. Jamal recommends longer passphrases, checks against lists of breached passwords, multi-factor authentication and changes only when compromise is suspected. Ms. Grant explains that rules which ignore human behaviour produce predictable passwords. The IT manager adopts the new rules after Jamal shows examples of the predictable patterns staff had been using. He also suggests that the booking system for members adopt the same breached-password check, which the supplier agrees to enable.

13.2 Password managers

IT staff manage many passwords for routers, camera recorders, supplier portals and service accounts. These were kept in a spreadsheet on the file server. Jamal recommends a password manager with individual accounts for each IT staff member, sharing only the entries each needs, and an access log. He moves the entries and deletes the spreadsheet. He learns that password managers make strong, unique passwords practical, because nobody has to remember them. Each IT staff member can see only the entries needed for their work, and the log shows who opened each entry.

13.3 Secrets in scripts

Jamal finds a backup script with a service account password written inside it. Anyone who can read the script can use the password. He rewrites the script to read the password from a protected configuration file readable only by the service account, and asks the IT manager to change the exposed password. Ms. Grant notes that secrets in scripts often spread through copies, backups and shared folders. He searches the other scripts on the server for similar passwords and finds two more, which he fixes in the same way.

13.4 Secrets in documents

Jamal searches Riverbend's shared drive, with permission, for documents containing the word password. He finds a setup guide for camera recorders listing current passwords and an old handover note with router credentials. He removes the passwords from both documents, replacing them with a reference to the password manager, and has the affected passwords changed. He learns that searching for exposed secrets periodically is a simple, valuable check. He adds the search to his monthly checklist, so new exposures are found quickly rather than lingering for years in shared folders.

Worked example

Jamal replaces forced monthly changes with passphrases and breach checks, moves IT passwords into a password manager and removes secrets from a script and documents.

Synthetic case. Secrets are synthetic.

Errors and limits

A password written in a script is exposed to anyone who can read it.

Exercises

Continue studying — lesson 13 (chapter 13 of 30)

← Chapter 12 · Course chapter index · Chapter 14 →

Continue to the next authored lesson.