Secure passwords
Secure passwords are an important prerequisite for ensuring the security of a system. Beckhoff delivers the images with standard user names and standard passwords for the operating system. These must be changed by the customer. Otherwise, your device is vulnerable to attack via the network and access by unauthorized personnel.
Controllers are delivered without password in the UEFI/BIOS. Here, too, it is recommended to assign a password.
A Security Wizard is integrated in the system. This is started directly after booting up the device during local access. This wizard requests the user to change the password. However, the password can also be changed locally using operating system tools.
The following applies:
- Passwords should be unique for each user and service.
- Password complexity: the password should contain capital and lower-case letters, numbers, punctuation marks and special characters.
- Password length: the password should be at least 10 characters long.
- Contrary to some previous recommendations, it is recommended that passwords are no longer changed regularly, but only after an incident in which passwords have become known to unauthorized persons. See also https://arstechnica.com/information-technology/2016/08/frequent-password-changes-are-the-enemy-of-security-ftc-technologist-says/
- It may be useful to schedule a mandatory waiting time after unsuccessful logon attempt.
Generate secure password
There are many ways to create a secure password. The following table describes a method of generating passwords. The procedure can also help to remember complex passwords:
Procedure | Example |
|---|---|
1. Start with one or two sentences. | Complex passwords are more secure |
2. Remove the spaces. | Complexpasswordsaremoresecure |
3. Abbreviate words or add spelling mistakes. | Complxpasswordsarmorescure |
4. Insert numbers and special characters to extend the password. | Complxpasswordsarmorescure#529954# |
Problematic passwords
Cyber criminals use sophisticated tools that enable high-performance attacks on passwords. Therefore, it is advisable to avoid:
- Words contained in dictionaries
- Words written backwards, common spelling mistakes, and abbreviations
- Repetitive sequences, e.g. 12345678 or abcdefgh
- Personal information, e.g. birthdays, ID numbers, telephone numbers