YT YouTube2Text

YouTube2Text → Transcripts → Employee Password Security Awareness Training 2026

Employee Password Security Awareness Training 2026 — Transcript

by DPO Solutions (Paul Rogers Security) · 9,028 words · 1,467 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:01Hello and welcome to another security
0:03awareness video. This time on everything
0:06to do with passwords and authentication.
0:08My name is Paul Rogers and I'm a cyber
0:10security pro with 30 years experience as
0:13an engineer and security governance
0:15expert and content creator for this
0:17channel. In this video, I hope to answer
0:20the most common questions you've been
0:21asking on the internet about passwords,
0:24such as what makes a good one? What are
0:27the different password attacks that are
0:28causing breaches? How to store
0:30passwords? What does MFA or multiffactor
0:33authentication do? And what is the best
0:36way to secure my phone? So, the video is
0:39broken into several chapters which means
0:41that you can jump to any particular area
0:43of interest to you or view the whole
0:45video to raise your general awareness of
0:47password technology. So, whatever suits
0:50your needs. So feel free to share this
0:52video with others that you think may
0:54benefit from this training such as
0:56colleagues and friends and also consider
0:58liking and subscribing to the channel to
1:00stay a breast of new security content
1:03notifications if you find it useful. I
1:06also encourage you to drop a comment on
1:08areas you'd like to see more videos on
1:10such as password cracking methods,
1:13hacking groups behind the biggest hacks,
1:15biggest breaches and how they happened
1:17or a breakdown of the cyber security
1:20jobs market. just let me know with a
1:22comment. So, let's get on with the
1:24presentation.
1:30This video is split up into four main
1:32sections designed to give you a view of
1:34each branch of password technology.
1:37In the first section on passwords, we
1:39cover the origins of passwords, the
1:42threats hackers pose to password
1:44security, the dos and don'ts of password
1:46selection, password attack types, and
1:50password technology variants, including
1:52passcodes, passphrases, and pass keys.
1:55In the section second section, we cover
1:57how to manage and store passwords
1:59securely with password managers and how
2:02we also do a comparison of five leading
2:05password manager products which you may
2:07find useful. Then in the third section,
2:10we focus on multiffac factor
2:12authentication and how it works along
2:14with its weaknesses. We also compare
2:16five leading MFA providers to help you
2:19choose one if you're in the market for
2:20one. And then finally, we look at mobile
2:23device security and which login methods
2:26work best for securing sensitive data.
2:29So pay attention to the chapters in the
2:30video timeline. And if you want to jump
2:32ahead at any time, you can do that. And
2:35of course, if you have any questions
2:36about any area, drop a comment below.
2:48Did you know the passwords first
2:50appeared in the 2n century BC or as they
2:53were referred to back then as
2:55watchwords. Back then the Roman military
2:58used these watchwords to identify f
3:00friend friend from foe with soldiers
3:02often receiving the day's password on a
3:04wooden tablet from a superior officer.
3:08This system was used for both military
3:09patrols and for securing campouts for
3:12hundreds of years and were most valuable
3:14on patrol night watches outside city
3:17gates where soldiers could recognize
3:19their comrades in the dark.
3:21Fast forward to World War I and two
3:24where we see another military
3:25application of pass passwords as code
3:27words and coded messages to exchange
3:30exchange military operational
3:32information between units and command
3:34nodes. Back then, Native Americans from
3:37at least 11 different tribes were
3:39employed by the US Army to use their
3:42native languages as a secure method of
3:44communication.
3:46Code talkers, as they were nicknamed,
3:48transmitted messages over military
3:50telephone or radio communication nets
3:53using formally or informally developed
3:55codes built upon their indigenous Native
3:57American languages. Their code was
4:00credited with some decisive victories
4:02and was never broken unlike the German
4:04Enigma machine.
4:07Later on in the 1960s, passwords
4:09formally evolved into the modern digital
4:12era in 1961 at MIT University.
4:16That's when professor Fernando Kbajo
4:18created passwords on a compatible time
4:21sharing system CTSS to allow multiple
4:25users to have private individual access
4:27to files on a shared mainframe computer.
4:31Then just over a decade later in 1973
4:34we see passwords created on the first
4:36internet system known as Arpanet by a
4:39British computer scientist called Peter
4:41Kerstein. Kerstein was in incidentally
4:45famous for co-creating the TCP protocol
4:48with Vint Surf and Bob KHN which was
4:51kind of important to the midm modern
4:52digital age to say the least.
4:55Since 1973 there was a host of
4:57developments around passwords including
4:59hashing hashing one-time passwords and
5:02cryptography developments. Then in 2017,
5:06Apple made a big leap forward from
5:09password only technology with the advent
5:11of facial recognition on mobile mobile
5:14devices, namely the iPhone X. This
5:17perhaps heralded the age of password
5:20passwordless login that we see today.
5:24Uh by the way, Gloria Exorcitis, um
5:27which you see here on the slide means
5:29glory of glory to the army. It's a
5:32saying that was often used between
5:34soldiers and appeared on Roman coins
5:36around 330 AD.
5:42Let's start here with a quick question
5:44to test your knowledge on passwords.
5:46It's okay if you don't know on the first
5:48guess, but by the end of this section, I
5:50hope you'll understand why the correct
5:52answer is C.
6:04In 2025, it's safe to say that most
6:06systems which use only passwords of
6:08average strength are no match for a
6:11determined hacker using password
6:13cracking tools and a good graphics
6:15graphics card or one of the many
6:17cloud-based cracking services like
6:19Crackstation and Go Crack. The truth is
6:22that modern password cracking tools
6:24enabled by AI powered smart guessing
6:26algorithms have made fast work of
6:29learning human behavior and how we
6:31create passwords.
6:33These algorithms work by calculating the
6:35frequency of various character
6:37combinations across millions of sample
6:39passwords ranging first from ranging
6:43first from the most common combinations
6:45and down to the rarest ones.
6:48According to the cyber security firm
6:50Kaperski,
6:51we rarely choose truly random passwords
6:55and our attempts at generating them pale
6:57in comparison to machines. We rely on
7:00common phrases, dates, names, street
7:03addresses, and patterns. Prei precisely
7:06what smart cracking algorithms are
7:08designed to exploit.
7:10Moreover, the human brain is such that
7:13if you ask a sample of folks to pick a
7:15number between 1 and 100, most will
7:18choose the same numbers. The YouTube
7:20channel Veritasium surf surveyed more
7:23than 200,000 people and found that the
7:27most popular numbers chosen to be 7, 37,
7:3142, 69, 73, and 77.
7:35So to further compound the problem with
7:37passwords, users tend to reuse the same
7:40passwords out of convenience across
7:42multiple applications and websites.
7:45Of course, hackers realize this as a
7:47common behavior and capitalize on it
7:49when cracking in to any account linked
7:51to you. Of course, cracking passwords is
7:55only one part of the problem, as there
7:57are other threats like social
7:59engineering, which we'll cover shortly.
8:04What you see here on the screen is some
8:07of the hacking methods a major crime uh
8:10group called Scattered Spider uses to
8:12hack businesses around the globe today.
8:16Scattered Spider is ranked as one of the
8:18most dangerous and active cyber crime
8:20gangs in the world at the moment and is
8:23linked to more than 100 targeted attacks
8:25across industries such as telecoms,
8:28finance, retail, and gaming. They've
8:30been linked to some high-profile
8:32ransomware attacks on Caesar's Palace
8:34and MGM resorts in Las Vegas and Markx
8:37and Spencer Hars Jaguar Land Rover and
8:41the Co-op in the UK. The group is one of
8:45a number of cyber gangs which are
8:46considered new age and comprised of
8:49mostly English-speaking teenage
8:51attackers. What's notable about this
8:53crime group is that they use more
8:55sophisticated attacks and a wider
8:57variety of tools than others.
9:00The gang relies heavily on social
9:02engineering t attacks, weak passwords,
9:05fake web domains, and SIM swapping
9:08techniques to bypass security controls
9:11and inject ransomware into
9:12organizations.
9:14Some known techniques they have used
9:16include posing as employees to gain
9:18access to computer rooms,
9:20using fake credentials gleaned from a
9:22LinkedIn profile, and other methods
9:25include duping employees to share their
9:27credentials over the phone by posing as
9:30tech support professionals and using
9:32fishing mails, fishing emails which were
9:34opened, which allowed employees with
9:36weak system passwords to be hacked on
9:38the network.
9:40The last issue of weak passwords is
9:42probably the most preventable one and is
9:44the one we're going to address in this
9:46presentation while showing you the
9:48options available to combat growing
9:50threats.
9:55In this slide, we're going to address
9:57the common question of what makes a
9:59strong password, i.e. the dos and
10:02don'ts.
10:03So on the column on the left, we're
10:05looking at the most current bad password
10:07practices based on research by security
10:10firms uh like NordPass.
10:12They advise that users should not use
10:15password, pass, secret, admin, login or
10:19any term that relates to a password or
10:21default login name like admin or
10:23administrator.
10:25The same goes for colloquial password
10:27terms like let me in, open sesame,
10:30welcome and others.
10:33Next, avoid number number alphabet or
10:37keyboard sequences like ABC D 1 2 3 4 1
10:41one one or querty anywhere in the
10:44password. So pass 1 2 3 4 or secret one
10:48one one would be examples of this. Then
10:52the advice not to use names, birthdays,
10:56years or place names. This is because
10:58password hacking tools will start with
11:00lists of this type of information in an
11:03effort to guess your password.
11:06Then the advice tells us not to use any
11:08animal names, story book type
11:10characters, sports team names or pop
11:13group or idol names in the password as
11:16again password cracking tools and
11:18hackers will use this information first
11:21in various types of attack attacks which
11:23we'll cover in the next slide.
11:25So then moving over to the do's column
11:27to the right, we see some password
11:29quality recommendations from uh
11:31government agencies like NIST and uh
11:34from Microsoft.
11:36So to answer a common question, how long
11:38should a password be? Well, the advice
11:41here is that the password should not be
11:43less than 16 characters. This used to be
11:4612, but is not considered strong enough
11:48anymore. The complexity of the password
11:51is key. So, passwords with a combination
11:54of upper case and lowercase characters
11:57with numbers and symbols makes them
11:58difficult to crack even with automated
12:00cracking tools.
12:02The next piece of advice is to answer
12:04the question, is it safe to reuse
12:07passwords? And of course, uh the answer
12:09to that is no. It's not safe to reuse
12:12the same or similar passwords on your
12:14accounts. This goes for all your work
12:16and personal accounts, plus any Wi-Fi
12:19passwords, email accounts, and anything
12:21else. Using the same password on your
12:23accounts makes the job easier for
12:25hackers if they breach just one of your
12:28accounts.
12:29Microsoft advises not to use any uh
12:32words found in the dictionary, people's
12:35names, character names, product names,
12:37or organization names as they are all
12:40likely to be included in password lists
12:42which hackers use.
12:45I know at this point that this can seem
12:47a bit overwhelming to remember when
12:49creating uh your password, which is why
12:51there are certain techniques that make
12:53things easier, such as using passphrases
12:56and password generation tools, which
12:59we'll discuss in upcoming slides.
13:02I would highly recommend investing in a
13:04password manager, which most of all
13:07includes a which most importantly
13:10includes password generator
13:11functionality.
13:13Uh the security company Nordpass stated
13:15that in 2024 the average person has 168
13:20personal passwords and 87 business
13:23passwords totaling a whopping 255
13:27accounts on average. You can see how
13:30problems could arise trying to manually
13:32set and update unique passwords for all
13:34of these. It's worth mentioning here
13:37that this list of dos and don'ts is not
13:40exhaustive. There are many other
13:42important considerations particularly in
13:44corporate environments when it comes to
13:46work work passwords such as password
13:48rotation, lockout and history policies
13:51in Windows and Unix environments. But
13:54you can subscribe to this channel to get
13:55notified on upcoming corporate best
13:58practice training for these uh type of
14:01advice or drop your contact email in the
14:04description so you get notified of any
14:06uh videos relating to this.
14:14So, before I cover the most common
14:16password attack methods, if I could ask
14:18you to consider subscribing to this
14:20channel. Your support allows me to
14:22continue creating and publishing free
14:24content like this regularly to help
14:26those interested in learning about cyber
14:28security. And of course, if you'd like
14:30to discuss your training needs in the
14:32area of cyber security, a link for that
14:34is in the description. So, now back to
14:37the presentation. Here are six
14:39well-known password attack methods.
14:41Starting with brute force. What is a
14:44brute force attack? Well, simply put,
14:46it's an automated attack method on
14:48passwords and encryption keys using
14:50different combinations of characters
14:53until the correct combination is found.
14:56It uses tools like John the Ripper,
14:58AirCrackng, and Loftrack, which attack
15:02password hash files found in operating
15:04system folders on Windows and Unix
15:07machines.
15:08This type of tool takes lots of
15:10processing power, but can be accelerated
15:12by multiple graphics cards and online
15:15dedicated cloud ser services to crack
15:17passwords quickly, particularly ones
15:20with eight characters or less. In
15:22practice, hackers may often copy a
15:25Windows SAM database or a NTDS.dit
15:29file um and use a tool offline tool to
15:33crack passwords on the local machine.
15:36Hackers will pay particular attention to
15:38any uh user accounts with administrative
15:41privileges as this allows them to
15:43install malware and connect into other
15:45mach machines such as important servers.
15:48A password hash, by the way, is a
15:50one-way encrypted version of a password
15:53that is stored in a database instead of
15:55a plain text password.
15:58This process uses a cryptographic
16:00function to transform a password into a
16:02unique fixed length string of characters
16:05that cannot be reversed. So it's
16:07basically a way of systems avoiding
16:09storing passwords and plain texts which
16:12would obviously make them vulnerable to
16:13hackers.
16:15So in the second form of attack, a
16:17dictionary attack, it's a type of attack
16:19where a tool like John the Ripper again
16:21will use a list of common passwords,
16:24dictionary words or work from lists of
16:26compromised credentials from the dark
16:28web to test against against account
16:31loginins.
16:33This is relatively relatively fast form
16:35of attack as it's working from known
16:37lists which are loaded into the app and
16:39are processed quickly.
16:41So then next on our list of attacks is
16:44rainbow tables. What are rainbow tables?
16:47Well, they are essentially lists of
16:49precomputed tables of hash values and
16:52they're matching plain text passwords.
16:54So if the hash can be looked up in a
16:56rainbow table, the plain text version
16:59will be revealed. Typical tools like
17:02rainbow crack, John the Ripper, and
17:03Brutus can be used for this process.
17:07This form of attack used to be used to
17:09be more common but has been defeated
17:11most of the time with the addition of
17:12salting of hashes.
17:15Sultting is a security measure that adds
17:17a unique random string of characters,
17:19assault if you want to say, to each
17:21password before it's hashed.
17:24This ensures that even if two users have
17:26the same password, the resulting hashes
17:29will be different. If you want to learn
17:31more about the technical details of all
17:33of this, there is a downloadable uh link
17:35to a down downloadable document with
17:38external references for this slide in
17:40the description.
17:42So in the next form of attack,
17:44credential stuffing. It's a technique
17:47used by hackers to reuse a user's stolen
17:50credentials on other accounts that may
17:52be linked to them. Hackers are well
17:54aware that users tend to use the same
17:57passwords across many accounts. This
18:00might look like a user using the same
18:02password for logging into their Netflix
18:04and Amazon Prime accounts. So if a list
18:08of Netflix use Netflix user accounts and
18:10passwords were leaked on the dark web, a
18:13hacker may look for other accounts
18:15linked to that user or users that they
18:18may be interested and then try a similar
18:20username with the same password on
18:22Amazon. This is a very common attack
18:25method. So, next on our list is password
18:28spraying or as it's called reverse brute
18:31force attack. It involves an attacker
18:34trying a single commonly occurring
18:36password against a large list of
18:38usernames to find a match. This of
18:41course uh is the opposite of a normal
18:44brids attack which tries many passwords
18:47against a single username.
18:50Usually attackers will leverage
18:51passwords discovered in large data
18:53breaches and test them against a list of
18:55users in a company database at a low
18:58frequency level to avoid an account
19:00lockout. Hence they are difficult to to
19:03detect.
19:05So sticking on this point of account
19:06lockout after covering five account
19:09attack methods so far it's always
19:11advisable to set an aggressive account
19:14lockout policy on your device. So, three
19:17attempts would be an appropriate setting
19:19here before an account lockout would
19:21occur. For very sensitive systems, a
19:24call to support staff may be required to
19:26unlock the account, similar to a banking
19:29app, which would require you to call
19:30into customer service.
19:33So, the last attack method has become
19:36the go-to method for cyber criminal
19:38gangs to get employee passwords and
19:41banking credentials quickly. This, of
19:43course, is social engineering.
19:46Social engineering as you know uh uses
19:49psychological tactics to manipulate
19:51people into taking a desired action like
19:53giving up confidential information such
19:56as passwords and pins.
19:58It can be conducted by email, social
20:00media, phone or in person and is now
20:03increasingly facilitated by AI
20:05technologies to make these attacks more
20:08realistic and deceptive.
20:11The security firm Proof Point estimates
20:13that social engineering may account for
20:1598% of cyber attacks, while other
20:18sources place it between 70 and 90%.
20:21Whichever statistic you believe, it's a
20:24critical issue in cyber security.
20:27There are a few other attack methods
20:28that I could cover here such as key
20:30loggers, man-in-the-middle attacks, mask
20:34mass password attacks, cerber roasting,
20:37which I might may include in an upcoming
20:39video on password cracking methods in a
20:42more of a deep dive on these types of
20:44attacks. Let me know if you'd like to
20:46see more in anformational video about
20:49other attacks. Uh if you want to go
20:52ahead and comment in the description and
20:54of course subscribe to the channel so
20:56you get notified when the new video
20:57drops.
20:59I would uh recommend some o of our other
21:01videos on fishing for which there are
21:03links at the end of the video where we
21:05cover many attack types and
21:07methodologies under the social
21:09engineering banner.
21:15So, it's a fact that most people and
21:17companies are not aware when and how
21:20often their passwords are breached and
21:21end up for sale on the dark web. It's
21:24known that more than 24 billion
21:26credentials are exposed each year in
21:29data breaches and h and about half of
21:31the affected parties use the same
21:33password 14 times.
21:36Cyber experts are attributing the rise
21:38of info stealer malware such as Luma C2
21:42to the dramatic rise in credential theft
21:45which can be delivered through fishing
21:46emails, malicious sites, and software
21:48downloads.
21:50So, how do you check if your password
21:52has been hacked and get notified about
21:54future hacks? Well, let's start with
21:56some free tools you can start using
21:58straight away. The first of which is
22:00Google Password Checkup.
22:03This one is simple and involves visiting
22:05passwords.google.com/checkupstart
22:10and logging into your Google account to
22:12check if it's been involved in any data
22:14breaches.
22:16The tool will then check your Chrome
22:18browser for stored credentials to
22:19compare with Google security databases
22:22and generate a detailed report with
22:23compromised passwords. It will also tell
22:26you about reused passwords and weak
22:28passwords, which is a handy preventative
22:31feature designed to limit your exposure
22:33to future breaches.
22:36The next free tool is have I have I been
22:39pawned, which will give you a report on
22:41data breaches since 2012 in instances
22:44where your email address and password
22:46were found in a data breach. So in my
22:49case, I noticed LinkedIn, Adobe, Drop,
22:52Dropbox, Twitter, and a few companies I
22:54didn't even know about uh which were
22:56included in data breaches, including
22:59People Data Labs, PDL, and the Post
23:01Millennial. This shows us the lack of
23:05control we really have over security
23:06once we create a login anywhere online.
23:10Then the next tool uh comes from
23:11Mozilla, which is also free. It provides
23:14many of the same results as have I been
23:17pawned, but it has a nice step-by-step
23:20remediation tool which takes you through
23:22all the remediation steps that you need.
23:25I'd recommend using all three tools and
23:27making a physical note of accounts
23:28you've fixed as you go along so you
23:31don't duplicate effort. Next, we move
23:33into the paid tools category, starting
23:35with Macaffy. Macaffy uh identity
23:39monitoring is more of a personal to tool
23:41to notify you of more types of threats.
23:45From its own website, it says, "We'll
23:47monitor the dark web for your personal
23:49info, including email, government IDs,
23:51credit cards, and bank account numbers,
23:54and more." It also says will help uh
23:58keep your personal info safe with early
24:00alerts if your data is found in the dark
24:02web an average of 10 months ahead of
24:06similar services. The full list of data
24:09that it monitors includes social
24:10security numbers at government IDs,
24:12driver's license numbers, passport
24:14numbers, tax IDs, dates of birth, credit
24:18card numbers, bank account numbers,
24:20usernames, insurance ID cards, email
24:22addresses, and phone numbers.
24:25They have three different uh plans which
24:27you can view on the link provided on the
24:30screen. So then last on our list is an
24:33enterprise project product which uh some
24:35of my business viewers might be
24:37interested in. The product comes from a
24:40company called recorded future and the
24:42name of the product is dark web
24:43intelligence.
24:45So their platform describes their
24:47product as a solution which enables you
24:49to automate the identific identification
24:51of proprietary data or loss credentials
24:54on dark marketplaces as well as mentions
24:58of your company brands or
25:00infrastructure.
25:02It also allows companies to uncover new
25:04and emerging exploits and malode tools
25:07relevant to your technology stack been
25:09developed and traded in dark web
25:11locations.
25:13One source on the web says threat
25:15intelligence uh cost for two user users
25:18is roughly $281,000
25:21over a three-year period license I
25:23guess. So this would place the product
25:26obviously in the high-end enterprise
25:28bracket. So obviously plan accordingly
25:31if you're in the market for something
25:33like that.
25:42A common question about password is
25:44what's the difference between them and
25:45passcodes and which one is better? Well,
25:48the answer to the first part of the
25:50question about the difference between
25:51the two is that passcodes are typically
25:54short numeric codes often used in
25:57banking apps or for fast access to a
26:00device such as you might see when
26:02unlocking your phone or a unlocking a
26:04screen saver. A password on the other
26:07hand is usually longer with a more
26:09complex string of characters, numbers,
26:11special characters which you use to log
26:14into operating systems, online accounts,
26:16apps as we've seen in previous slides.
26:19Passwords are more secure due to their
26:21secure your complexity and ability to
26:24set policies for. Whereas passcodes are
26:26convenient but less secure when they're
26:29used on their own with any without any
26:31other form of authentication.
26:33So, it's quite common to see passcodes
26:35used as a secondary form of
26:37authentication after first being
26:39verified through another means. So, what
26:42does that look like? Well, if you've
26:45ever signed up for an online banking on
26:47your phone, you will first enroll your
26:49phone once with the registration number,
26:52perhaps your account details, password,
26:54and a user generated uh passcode. And
26:57then every time after that you access
27:00your account details through your
27:02banking app just with the passcode on
27:04its own for speed of use.
27:17So another common question is how do I
27:19make my passwords more secure?
27:22Well, a common method is through the use
27:24of passphrases which are made up of
27:27unrelated words but are easily memorable
27:30to the user. A passphrase example like
27:34railway, sky, Venus, mountain is easy to
27:37remember and is actually 26 characters
27:40long and therefore considered strong as
27:43they're a lot harder to guess when
27:44compared to normal passwords which are
27:47crackable on average within an hour
27:49using a cracking tools like John the
27:51Ripper. uh statistic actually out there
27:54is that uh most normal passwords are
27:58cracked 59% of the time within just an
28:01hour.
28:03So passphrases can be further enhanced
28:05with pins and biometrics
28:08like Apple's face ID and thumbrint
28:11identification as seen quite commonly uh
28:13used in banking apps and in crypto
28:16wallets making them extremely strong.
28:20While passphrases are superior to
28:22passwords, there are a few potential
28:24weaknesses to be aware of. Like
28:26password, past phrases have many of the
28:29same vulnerabilities as passwords do.
28:32Passwords do as they are vulnerable to
28:34social engineering and insecure storage
28:37practices. This means that users may be
28:40duped into sharing their password with
28:42fake uh websites and hackers who may
28:45trick you into believing they're
28:47legitimate. So passphrases on their own
28:50are vulnerable to the same data breaches
28:52as regular passwords when dumps of
28:54breached credentials appear on lists on
28:57the dark web.
28:59Users may also make the mistake of
29:01reusing the same passphrase ac across
29:03multiple accounts and use predictable
29:06phrases like the lyrics of a song. And
29:09then lastly, passphrases can sometimes
29:11cause annoyance to users who have to
29:14type them in, particularly on devices
29:15like TVs where remote controls may be
29:18used to type them out. This can lead to
29:21users rejecting their use and opting for
29:23short passwords uh for speed instead.
29:34The second method uh for you securing
29:36your password is through the use of pass
29:38keys. Pass keys are big text answer to
29:43passwordless login. Uh you might have
29:45noticed them being used by Google,
29:48Amazon, eBay, Revolute and other big
29:51techs. They are designed to help prevent
29:54fishing and the problem of sharing the
29:56same password across multiple web apps
29:58and services.
30:00They work by using a one-time enrollment
30:02process where users use their face,
30:05thumbrint, pattern, or pin to link a
30:08device to a service such as Google
30:10Password Manager. Once this is done,
30:12users can entirely avoid using a type
30:15password to access Google services from
30:17then on.
30:19Pass keys have the advantage of being
30:21faster than typing a password. Uh more
30:24secure in that they are resistant to
30:25password guessing. uh they prevent
30:28password reuse and provide protection
30:31against fishing attacks. So in a fishing
30:33attack, a user unintentionally enters
30:35their real password on a deceptive
30:37website created usually created by a
30:40cyber criminal. This doesn't work with
30:42pass keys. Uh the keys we mentioned
30:44earlier only work uh on the URL of the
30:48real app or website. So this prevents
30:51fishing. Then there's the fact that pass
30:54keys are stored locally on your device.
30:56Which means that unlike your password
30:58which may get hacked in a big databach
31:01on a server you probably never heard of,
31:03pass keys are stored on your local
31:05device which is a much smaller target
31:08for hackers.
31:10Pass keys are not invulnerable though as
31:12concerns have been raised about the
31:14difficulty in implementing them in
31:15organizations and the fact that the
31:18underlying protocol called web o w
31:23au t hn uh on which pass keys are based
31:27is inherently very insecure.
31:31So for those companies who are willing
31:32to make the move away from pass
31:34passwords, pass keys are much more
31:36secure than usergenerated passwords and
31:39expect them to be rolled out uh more and
31:42more as they move towards a passwordless
31:44login um environment on the internet.
31:52Another question that comes up
31:53frequently is are password recovery
31:56questions a secure method of
31:58authentication.
32:00Well, the short answer is no. Uh but you
32:04may still encounter them on uh websites
32:06that are used but mostly as a legacy
32:09feature. The fact is that many times
32:12these answers, these password recovery
32:14answers can be discovered through social
32:16media searches, public record searches
32:19and even social engineering.
32:21The prepared preferred method of
32:23recovery is through password reset
32:25emails uh with an embedded tokenized
32:28link and a short expiration timeout.
32:31Many companies such as Google and
32:33Microsoft will add a second layer of
32:35authentication on top of these uh
32:38recovery emails through the use of a
32:40one-time password generated by an
32:42authenticator app to for further secure
32:45the process. So, in effect, it's a a
32:48form of two-factor authentication that
32:49you will see out there quite a lot um in
32:52the password recovery um efforts
32:55particularly by big companies like
32:56Microsoft.
33:02So, just quickly on this slide, the main
33:04cyber security questions for 2025
33:07circling around the internet fell into
33:09four categories this year. Those
33:11categories were a AI powered attacks, b
33:15quantum computing threats, c supply
33:18supply chain vulnerabilities, and d r
33:20ransomware as a service. So with data
33:23breaches in the US now costing companies
33:25an average 10.22 billion and the global
33:29cost of ransomware projected to hit 57
33:32billion uh by the end of 2025, you may
33:35be interested to hear more on one or
33:37more about the latest forms of threats.
33:40That's why I encourage you to drop a
33:41comment below with your choice or
33:43choices of topics and subscribe to the
33:46channel to get notified when the next
33:48video is published about one of these
33:49categories. Remember, we can also create
33:52awareness presentations for corporate
33:54customers on any of these top topics. So
33:57again, let me know in the com comment
33:59section if any of these uh may be of
34:01interest to you.
34:18In this slide, we answered the question,
34:21how should I store my passwords?
34:23Well, the best answer to that question
34:25is probably with the use of password
34:28managers.
34:29Password managers are programs that
34:31allow you to store account passwords and
34:33other personal information such as
34:35credit card numbers, addresses, phone
34:37numbers, and secure notes in encrypted
34:40form. The data, this data is stored in a
34:44password vault either locally or in the
34:46cloud and is typically accessed with the
34:49master password authenticator app or
34:52biometric data like a facial scan or
34:54fingerprint for strong security.
34:57So beyond the peace of mind that comes
34:59with having all your passwords stored
35:01securely, password managers will
35:03autofill your in login information on
35:05websites they recognize, allowing you to
35:08access all your accounts seamlessly.
35:11So why do you need a password manager?
35:14Well, according to Microsoft, many
35:15people use weak passwords that are
35:17easily guessed and reused on several
35:20different websites, making them targets
35:23for hacking and identity theft. When you
35:26use the same password for any of your
35:28email, bank, social media, or healthcare
35:30accounts, an identity thief who may have
35:33found just one of your login information
35:36on the dark web would be able to test
35:38the same password against any other
35:40accounts they may discover on a list or
35:43by searching on Google. So, what are
35:45some other benefits of a password
35:47manager? Well, password managers let you
35:50create strong, unique passwords for you
35:53for each of your accounts and let those
35:55passwords be automatically filled in
35:57when you go to use them. Using the
35:59autofill feature for each site you have
36:02an account with saves you time.
36:05Password managers also protect your
36:06identity by checking dark websites for
36:09stolen credentials and email addresses.
36:12So, the sad fact is that millions of
36:14online users have their passwords, email
36:16addresses, and more stolen every year
36:18due to companies being breached and
36:21never being informed about it. Password
36:23managers will alert users if their
36:25details show up in online dark
36:27marketplaces and alert them to change
36:30them immediately and check with credit
36:31reporting service providers to check for
36:34fraud.
36:35Password managers can also let you know
36:37about fishing sites. So passwords stored
36:40in a password manager manager vault are
36:42matched to a specific URL when first
36:44created. So if you land in a cloned
36:46fishing site such as a fake banking
36:48site, the credentials won't work and
36:50you'll get an alert, thus keeping your
36:52personal information safe from criminals
36:54who are trying to steal your personal
36:56information.
36:58So with so many of us using hundreds of
37:00personal and work accounts and the need
37:03to keep password unique and strong,
37:05password managers fill an essential gap
37:07and give you peace of mind. In the next
37:09slide, we'll look at five popular
37:11password managers and what they can
37:13offer.
37:19So in this section I'm going to compare
37:21some top password managers ranked by
37:23names such as uh by gardener PC Mag and
37:26a few other rating agencies. I feel this
37:29is an important exercise as password
37:31protection gives you perhaps the best
37:33bang for buck defense against hackers
37:36and you get to see some of the other
37:37benefits which you might not have
37:39thought of. I'm also going to include a
37:42link in the description with further
37:43information on each of the brands
37:45mentioned here as there are a lot of
37:47extra information to share if you want
37:48to dive deeper into getting getting one
37:51of these products yourself. And
37:53remember, if you'd like to see a video
37:55just about password managers and their
37:57features, comment below and say yes, I'd
38:00like to see a video on password managers
38:03and I'll line something up.
38:08So in this chart chart we looked at 10
38:11areas for each of the password man
38:13managers mentioned in the previous slide
38:15which were last pass Dashlane keeper one
38:19password and bit warden. Each of these
38:22names are wellestablished players in the
38:24field and compete closely with each
38:25other on password features with slight
38:28variations on free versus paid elements
38:31and what each product is known to
38:33specialize in. So you'll notice that
38:35there are annotations with asterisks
38:37such as asterisk 1, asterisk 2, etc. in
38:41various locations. These annotations
38:43link to the information beneath the
38:45chart. So for example, you see asterisk
38:48one beside LastPass, which links to the
38:50notation at the bottom, best known for
38:53ease of use by Consumer Reports.
38:55However, they suffered a data breach in
38:56222 which eroded customer trust. And
39:00then asterisk 2 is for Dashlane which is
39:04in in quotes considered best known for
39:06security features and so on.
39:09So what I recommend is that you pause
39:11the video at any point to read the notes
39:13to read over everything and I'll weigh
39:16in with my opinion based on all the
39:18expert reviews.
39:20As I mentioned in the previous slide,
39:22I'm going to include a link in the
39:23description with more information
39:25including pricing on each of these
39:26features as there's a bit of depth here
39:29in explaining each one.
39:31I'll start with ruling out the ones that
39:33would be uh no for me and why. So, let's
39:38go ahead then with the review.
39:40Firstly, LastPass is a good product, but
39:42clearly having suffered a large data
39:44breach in 2022, which exposed the data
39:47on 33 million individual users and
39:50100,000 businesses and also the fact
39:53that they had to revise their story on
39:55what actually compromise, what the
39:56actual compromise was means that the
39:59product really is a non-starter for me.
40:02Then Dashlane uh gets three dings
40:05against it based on price having an
40:08awkward emergency access procedure and
40:11then no secure notes on mobile devices
40:14which I believe is important. Emergency
40:16access is a feature in password managers
40:18that allows a trusted contact such as
40:20your spouse to gain access to your
40:23password vault in case of emergencies
40:25such as death or incapacitation
40:28which obviously can be very important
40:29should should the worst happen. While
40:32secure notes are encrypted digital nodes
40:34stored within a password manage manager
40:37designed to hold sensitive information
40:40that doesn't fit in a standard password
40:42field. They protect data like software
40:44licenses, pins, security question
40:46answers, and account numbers keeping
40:49keeping it safe and organized along with
40:51other credentials.
40:54The next product I would uh say no to is
40:56Bit Warden. Due to a lack of important
40:58functionality in the dark web monitoring
41:00department. As you'll remember from
41:03previous slides, this feature allow
41:05allows monitoring of dark websites for
41:07lists of breach passwords and email
41:09addresses which may be for sale. So
41:12having live alerting of a breach is of
41:14critical importance. So you can respond
41:17by changing your your account passwords.
41:20This leaves us with keeper and one
41:22password which are closely matched.
41:25However, as one password does not have
41:27email breach uh monitoring as part of
41:29its offering which I think makes that a
41:31significant flaw. This leaves us with
41:34keeper which would make my
41:35recommendation given its all round
41:37feature set and competitive pricing. Of
41:40course, if you have your opinion on
41:41these products or others or feel that
41:43there's another password manager that is
41:45better than any of these, drop a comment
41:47below with your experience.
41:59So, up to now we've mostly covered
42:01single factor authentication methods,
42:03namely passwords, passphrases, and pass
42:05keys. Now it's time to discuss MFA or
42:09multiffactor authentication as it stands
42:11for. So what is multiffactor
42:13authentication?
42:15Well, it's a general term for login
42:17security which involves two or more
42:19authentication methods which are needed
42:22to gain access to a system. The method
42:25can be used for something you know,
42:27something you have or something you are.
42:30So let's explain what that looks like.
42:33So let's say you want to log into your
42:35workplace uh from home. Well, with multi
42:38multiffactor authentication, you will
42:40probably first connect via an app on
42:42your device like uh using Cisco secure
42:44client or checkpoint secure remote
42:47access or something like that which will
42:49prompt you first for to enter a username
42:52and a password and then secondly it will
42:55look for something else like a code from
42:56a text message, a onetime password from
42:59an anti- authenticator app or hardware
43:02token. So in this scenario, the username
43:05and password is something you know and
43:07the device used to receive or generate
43:09the code is something you have which
43:11constitutes multiffactor authentication.
43:15This second form of authentication
43:17effectively means that even if your
43:18username and password are leaked out
43:20onto the dark web or a hacker has
43:22managed to place malware onto your
43:24machine with the intention of stealing
43:26your credentials that these attacks will
43:28probably fail.
43:30So there are a range of corporate and
43:32personal MFA products which are popular
43:35in this space. A few common free ones
43:38are phone authenticator apps like Google
43:40authenticator and Microsoft
43:42authenticator which generate a new code
43:44every 60 seconds. Then we have other
43:48types of MFA technology including
43:50physical key fobs and hardware keys
43:53which plug into USB ports on uh mobile
43:56devices.
43:57We then also have voice-based
43:59authentication which is offered through
44:01services like Microsoft Entra ID where
44:04users are validated through an automated
44:06phone attendant which makes an outbound
44:08outbound call to the user for
44:10verification.
44:12In the next two slides, I'll show you
44:14some weaknesses in the technology and a
44:16comparison chart of five top MFA
44:19providers and their feature sets.
44:26So let's look at some MFA weaknesses. So
44:29MFA technology is not 100% f foolproof.
44:33So let's look at some five known common
44:35weaknesses uh through its use. The first
44:38one I want to talk about is SIM
44:40swapping. So what what's what is that?
44:43SIM swapping is a type of fraud where a
44:45hacker tricks a mobile carrier into
44:48transferring a victim's phone number to
44:50a new SIM card that the hacker controls.
44:53So if the hacker succeeds, it allows
44:55them to intercept one-time passwords and
44:58other authentication codes via SMS,
45:01thereby bypassing multiffactor
45:03authentication and gaining un
45:05unauthorized access to the victim's work
45:07account login or banking apps, email or
45:11cryptocurrency wallets.
45:13Some hackers will go one step further by
45:15performing account takeovers where they
45:17use these codes to reset passwords and
45:20take over the victim's account causing
45:22significant harm to individuals and
45:24businesses.
45:26Second on our list is social engineering
45:29which may involve different techniques
45:30to deceive users into taking an action
45:33to allow hackers to bypass multiffactor
45:35authentication.
45:37Two commonly used methods are called
45:39prompt bombing and service desk attacks.
45:43Uh, prompt bombing is an attack method
45:45where attackers will send out repeated
45:47requests to a victim's phone, asking
45:49them to approve a login until the victim
45:52gives in and approves the login out of
45:54annoyance.
45:55Attackers will usually already have the
45:57victim's login and password before
45:59attempting the this maneuver, and
46:01attackers may spoof where the request
46:03for authentication came from to make it
46:05look like their employer, bank, or other
46:07trusted party trusted party initiated
46:10it.
46:11In the case of service desk attacks,
46:13hackers may call a corporate help desk
46:15using a ruse that they're an employee
46:18who's lost their phone or can't access
46:20their authenticator app and need a code
46:22to access their work or banking app.
46:25Normally, the hacker will have
46:26sufficient identity information on the
46:28victim to convince the help desk that
46:30they are in fact who they say they are.
46:33These tactics have been linked to cyber
46:35crime groups like scattered sky
46:37scattered spider and octopus.
46:40specifically the attack and NGM grand
46:42which we mentioned earlier in the video.
46:44Use the service desk attack to gain
46:46access to their network. If you want to
46:49hear more about these two groups and
46:51their history of attacks and methods,
46:52drop a comment below and I'll include
46:54them in an upcoming video.
46:56So then number three on our list is an
46:58adversary in the middle attack.
47:00Sometimes referred to as
47:01man-in-the-middle attacks. So in this
47:03case, users may land on a lookalike
47:05banking website, fake login screen, or a
47:08fake social media site after clicking on
47:10a fishing link or downloading malware.
47:13At this point, unsuspecting users may be
47:15duped into entering in their two-factor
47:18codes for authentication, believing the
47:20app or website to be legitimate.
47:23Meanwhile, hackers are waiting and
47:24deploy a method called 2FA or two-factor
47:27authentication pass on to simultaneously
47:30use these codes to authenticate on a on
47:33the real site, thereby defeating the
47:34multi- factor uh challenge.
47:38Again, once they're into your account,
47:40they can take it over, change passwords,
47:42drain funds, etc., leaving the victim
47:45not suspecting they've done anything
47:46wrong. An example of this tactic has
47:49been used by e-crime groups such as
47:51storm 1167
47:54who are known for create crafting fake
47:56Microsoft authentication pages to
47:59harvest credentials where they mimic the
48:00MFA step of the Microsoft login process
48:04prompting the victim to put in their MFA
48:06code and grant the attacker access. From
48:09there they gain access to a legitimate
48:11email account and can use it as a
48:13platform for a multi-stage fishing
48:15attack.
48:17So then number four is session hijacking
48:20which involves taking over active user
48:22accounts through stolen cookies or API
48:24tokens allowing them to impersonate
48:27legitimate users access sensitive system
48:30systems and execute ransomware attacks
48:33all while flying under the radar of
48:35traditional security tools.
48:37So how does it work? An attacker uses
48:40eaves drop eavesdropping to monitor
48:42legitimate user sessions such as a
48:44connection to a banking site or an
48:46employee VPN session into their work
48:48environment. The ta attacker then uses
48:50malware or cross-ite scripting to steal
48:53that cookie or token stored in the
48:55victim's machine thereby bypassing MFA
48:59and impersonating the legitimate user in
49:01in their active session effectively
49:03taking over their account. As you can
49:05see perhaps why at this point that
49:07hacking groups are difficult to defend
49:09against as they seemingly have a
49:11sophisticated array of tools to overcome
49:13even the most secure technologies.
49:17The lastly number five in our list is
49:19the next weakness which is user
49:21lockouts. This refers to inst instances
49:24where users find themselves in a
49:26situation where they can't access their
49:27authenticator app. they can't receive a
49:30phone signal or for push notifications
49:33or experience a lockout due to excessive
49:36failed code entry attempts. So even
49:39lockouts due to non-compliant devices uh
49:41can cause lockout in devices. These
49:44issues can lead to rejection of using
49:46MFA in the first place and in some cases
49:49disabling it out of frustration.
49:54So this slide we're showing you a
49:56multiffactor authentication product
49:58comparison. So see these are five top
50:01multiffactor authentication products uh
50:04and how they compare so that if you're
50:06in the market for buying one of these
50:08products you can make an informed
50:09decision.
50:11So starting from our first row, we look
50:13at a cost comparison of Cisco Juo, Oaka
50:17Adaptive, Microsoft Entra, Ping
50:20Identity, and Google Authenticator.
50:23Google is actually free, so it rates top
50:25in the cost department. This is then
50:27followed by Jio at $3 per user per
50:30month, then Microsoft Entra at $6 per
50:33user per month, and Adaptive at $17 per
50:37user per month. Bottom of the cost list
50:40is Ping identity with a high entry point
50:42at $20,000 per year.
50:46On the next row, we look at the primary
50:48usage for each of these five five
50:50products. We see that Duo is most suited
50:52to quick deployments in small and
50:54mediumsiz businesses. Octa is best
50:58geared towards non-Microsoft multi-app
51:01environments while Microsoft Entra is as
51:04you would expect heavily Microsoft/Asure
51:08ccentric with deep integrations into
51:10their own Microsoft applications.
51:13Then looking at ping identity we see
51:15that it's targeted targeting large
51:17complex enterprise class of business
51:20hence explaining the $20,000 entry price
51:22perhaps. And then last on this row is
51:25Google Authenticator, which was really
51:27only designed as a personal use product
51:29commonly used as an app on cell phones
51:32without any form of centralized
51:33management.
51:35And now looking at the last row, we
51:37reviewed the key weaknesses of each
51:39product starting from Cisco Duo. The
51:42main weakness here is that it's not
51:44quite fit for large complex
51:46environments. Yet it's it's evolving as
51:48time goes on. The low monthly price here
51:52is perhaps reflective of this fact.
51:55Next, we here uh look at Octa. Octa can
51:58come in on the expensive side at scale
52:00as we see that $17 per seat per month
52:03can rack up quickly in expense in larger
52:06environments.
52:08Next, Microsoft Entra, which has a main
52:11weakness of not being suitable outside
52:13of Microsoft shops. So really you could
52:15say that it's really only designed for
52:17Microsoft Asia environments.
52:20Now looking at ping identity, the main
52:22technical drawback here is the
52:24complexity of the product leading to a
52:26steep learning curve for product owners.
52:29This of course is not uncommon with
52:30enterprise solutions as they're designed
52:33to tackle complex nuanced problems. And
52:37then lastly on our categorization here
52:40is Google. Although it's a free product,
52:43it lacks advanced features like adaptive
52:45policies and end-to-end encryptions. So
52:49just an aside note on adaptive policies
52:51and what they are, they're essentially
52:53dynamic rules that adjust the level of
52:55multiffactor authentication required for
52:57a login based on realtime risk
53:00assessments of factors like location,
53:03device, and user behavior. So instead of
53:06a one-sizefits-all approach, adaptive
53:09policies balance strong security with
53:12user convenience by requiring fewer
53:14steps for low-risk login like uh from a
53:17trusted device and location and stepping
53:19up the authentication requirements for
53:21high-risk situations such as a login
53:24from an unfamiliar device or location.
53:36In this slide, we ask the question, how
53:39do I secure my mobile device? Mobile
53:42devices continue to be a favorite
53:44amongst hackers in 2025 as more users
53:47browse with their phones and tablets
53:49than desktops. So, security on these
53:51devices is just as important than
53:53anything else, which is why it's good to
53:55know what the best forms of security
53:57are.
53:59Well, basically there are five common
54:00methods of security on mobile devices.
54:03Two of which are considered very secure
54:04from a login perspective. The five
54:07method five common methods include
54:09passcodes, pattern recognition,
54:12passwords, biometric security and
54:15hardware security keys. The first three
54:17of these are considered not to to be
54:20that secure on the security front as
54:22malware and nearby threat actors can
54:24observe you while you enter your
54:26credentials. In other words, passcodes,
54:28patterns, and passwords can be defeated
54:30by activities such as bruce force brute
54:33force attacks, shoulder suffering,
54:35social engineering, and fishing
54:37websites, which are all in the business
54:39of stealing credentials through the
54:41easiest method possible.
54:44Which leaves us then with the two other
54:46options for security, biometrics and
54:48hardware security keys, which are both
54:51considered much stronger because they
54:53are rely on physical components to make
54:55them work. So, you may well be familiar
54:57with Apple's Face ID and Touch ID are on
55:01the Android platform Android's face
55:03unlock and fingerprint unlock features.
55:06These are prime examples of physical
55:08uniqueness because they estimate that
55:10the chances of another random person
55:12unlock unlocking the device is less than
55:141 in 1 million. Apple's Face ID has a
55:17very high degree of security in that it
55:19performs a livveness check which ensures
55:22a real life person is authenticating to
55:24the device. It uses a sophisticated 3D
55:27system to create a mathematical
55:29representation of your face, which is
55:31encrypted and protected within the
55:33phone's secure enclave, as it's known,
55:35meaning your facial data is not shared
55:37or stored on Apple's servers for privacy
55:40reasons.
55:42Android also supports face unlock and
55:45face fingerprint authentication, which
55:47can super supersede the need for
55:48patterns, pins, and passwords on that
55:51platform for authentication.
55:54But perhaps the most powerful
55:56authentication method, however, is a sec
55:58hardware security key, which can either
56:01plug into the devices physical charging
56:04port or connect via nearfield
56:05communication or Bluetooth.
56:08Hardware keys have the advantage of
56:10being highly resistant to fishing and
56:12other social engineering attacks because
56:14they require a physical presence and
56:16interaction with the device. Examples of
56:19mobile compatible keys include Ubico
56:22from UBI and Google's Titan security
56:25key. These devices may be used for the
56:28physical device login and many web app
56:31web app authentications that support
56:33them. They are also not limited to
56:35mobiles as they also work with PCs and
56:37laptops. Hardware keys are often used as
56:41a good option for protecting devices
56:43holding highly sensitive data or
56:45government data um which may be
56:48particularly of interest to hackers.
56:51Of course, passwords are only part of
56:54the picture with protecting mobile
56:56devices particularly corporate assets
56:58assets which may hold sensitive data and
57:01provide a way into the corporate network
57:03if they're not properly secured. To get
57:06a deeper view of corporate mobile
57:07security best practice for your staff,
57:10subscribe to the channel to get notified
57:12for an upcoming awareness video on the
57:14topic or drop a comment uh with your
57:16email on the in the bottom of this video
57:19to get notified.
57:25So let's have a quick test of your
57:27knowledge. The question here is which is
57:29better security for a mobile device?
57:32Choose two of the options.
57:35So the answer in this slide is B and C
57:38as they rely on physical elements i.e. a
57:41facial scan and a physical key that you
57:44must plug in. With regards to question A
57:47or answer A rather while 12 character
57:49complex passwords are strong, they're
57:51still vulnerable to malware on your
57:53device such as key loggers which hackers
57:55can use to track your keystrokes in the
57:57background.
57:59Option D, complex login pattern is
58:02weaker as well as it's vulnerable to
58:03shoulder suffering and video
58:05surveillance which may pick up your
58:07thumb movements without your knowledge.
58:10There's also an increased uh risk that
58:12you'll forget the pattern and lock
58:13yourself out permanently from the
58:15device.
58:18So in this slide I'm showing you a quick
58:20guide on how to protect protect and
58:22manage your passwords on all your
58:23devices. The most important things to
58:26pay attention to on this slide is to use
58:28at least 16 characters if you're using
58:31passwords, but consider switching to
58:33long passphrases, which are more
58:35practical to remember and harder to
58:37crack. The fact is these days that the
58:40computational power hackers have at
58:42their disposal in cracking passwords is
58:44immense and the 59% of passwords are
58:47cracked in under an hour according to
58:49the security firm Kaperski. So for your
58:52online accounts, I highly recommend
58:54password managers. You can see my pick
58:57from password manager section of the
58:59video. Although passwords and
59:02passphrases can be strong, they're not
59:04as good as multiffactor authentication
59:06and biometrics. So take the time to
59:09enable MFA whenever it's an option and
59:12when using your phone. Don't rely on
59:14passcodes or screen pattern login. Use
59:17face recognition or fingerprint
59:19identification.
59:25So just quickly here just to remind you
59:27that we have other training videos on
59:29our channel like the ones you see here
59:31on this slide on cyber security
59:34awareness, fishing, data privacy and
59:37many other topics. We also have a design
59:40service for training content. And
59:42lastly, you can join our weight list for
59:44upcoming LMS type training for staff on
59:47our site at datah privacy.io
59:49AO/Weightlist.
59:52So this is our LMS type training which
59:54is offered for organization
59:56organizations wanting to conduct more
59:58formal modular training for employees
1:00:01with the enrollment tracking features
1:00:03certificates etc. You'll also find links
1:00:07for these and free bonus reference
1:00:09resources for this video in the
1:00:11description which you may find useful.
1:00:16Well, this brings us to a close on our
1:00:18password security awareness
1:00:20presentation. I hope you've learned a
1:00:22thing or two that you will find useful
1:00:23for your own devices. And remember to
1:00:26subscribe to the channel. And if you're
1:00:28looking for the full corporate LMS
1:00:30version of this training, use the link
1:00:33data privacy data privacy.io/weightlist.
1:00:37The link is there on the screen to get
1:00:40notified when it's published. Uh there
1:00:42are links of course below the video uh
1:00:44for different free resources and other
1:00:47links to other training. And uh I thank
1:00:50you for watching and I'll hope to see
1:00:51you again in the next training video.
1:00:53Thanks for watching.

About this transcript

This page contains the full transcript of Employee Password Security Awareness Training 2026 by DPO Solutions (Paul Rogers Security), generated from the public captions YouTube serves with the video. The transcript has 9,028 words across 1,467 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to choose a caption track available on the video.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, caption language selection, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.