Cybersecurity Awareness Fact Sheet
For public distribution – Updated August 2024
Did you know that more than 10 billion login credentials have been exposed by data breaches in 2024? Follow these best practices to protect both your work and personal accounts from compromise.
Creating a Strong Password
- Do not reuse or recycle passwords, especially across work and personal accounts. If you reuse a password and a hacker cracks one of them, they may try the recovered passwords on your other accounts too.
- Do not include personal identifiers like your phone number, name, child or pet’s name, or birth date. Cyber criminals can easily research any personal information you’ve shared online and use it to guess your password.
- Utilize abbreviations or misspellings to avoid using singular words that can be found in a dictionary. Avoid commonly used words (e.g., colors, fruits, animals, days) or phrases (e.g., “Password1234,” “Admin1”).
- Do not use repetitive characters or patterns (e.g., “0000,” “1234,” “aaa,” or “7878”).
- Use a long password. According to NIST guidance, you should consider using the longest password permissible (15 or more characters).
- Consider using a unique passphrase.
Tips & Best Practices
- Implement strong, long, and complex passwords.
- Do not share your passwords with anyone.
- Watch out for credential theft via phishing emails, calls, social media messages, or fake online login pages.
- Use a trusted commercial password manager for personal accounts. Users only need to remember a master password in order to access all of their accounts.
- Enable multi-factor authentication (MFA) whenever available to add an extra layer of protection to your accounts. Select app or device-based authentication methods, which are more secure than phone call, text message, or email.
What’s a Passphrase?
- A passphrase is a long sequence of random words that is easy to remember but difficult to crack. Its effectiveness comes from its length and randomness.
- A strong passphrase is “Trekker-Jeep-Sandwich-Eagle-Wedding,” which is better than one with similar, predictable words like “Apple-Banana-Watermelon-Orange.”
Diplomatic Security Service
U.S. Department of State
