6 S UMM E R 2 0 2 3 I used a very popular password manager for over 10 years until they announced in late 2022 that an unauthorized 3rd party obtained copies of encrypted and unencrypted customer data. In short, my encrypted password vault of 10 years and thousands of secrets was now in the wild. Fortunately, a strong master password and strong encryption were still protecting my sites, usernames, and passwords from being instantly useable to compromise my entire digital life. There were certainly a lot of changes through the years since entering my first password into the password manager system. But this experience revealed that I did not have a complete strategy in place to manage the quantity and changing complexities of my online identities. While it was a good start, I was only managing certain parts of my identity, like usernames and passwords, and not thinking about all the aspects related to managing my digital estate. COMMON ELEMENTS OF ONLINE IDENTITY The primary ways we authenticate ourselves online include usernames, email addresses, passwords, or cell phone numbers. Secondary or multi-factor authentication may involve text messages, emails with verification links/codes, authenticator apps, push notifications to a mobile app, security questions/ answers, a hardware token such as a Yubikey, or another physical device. There are three important categories you’ll want to think about: • Your account recovery methods – These are the methods you fall back to when primary or multi-factor methods fail, and we must “recover” access to an online account. Examples include primary/secondary email addresses, text messages, security questions, or multifactor authentication (MFA) backup codes. • Identity continuity, in the event of major life events – How do you manage online accounts with other people, such as a spouse or significant other, coworker, manager, co-founder or successor, survivor’s post-mortem, or an estate executor? Are you managing these details in a way that plans for a loss of access to your phone apps or text messages due to a theft, loss, or disablement? • Different contexts where your identities exist – It’s become necessary to develop a proactive plan for how to manage the numerous aspects that make up our online identities. These include employee accounts, cell phone app accounts/passwords, personal and home accounts, small business accounts, children’s accounts, online shopping, financial accounts, online bill payments, identity monitoring services, etc. While passwords might be the most frustrating and single greatest weakness in our online lives, there are so many other DEAL WITH YOUR ONLINE IDENTITY CRISIS By Terry L. Allen, CISSP Sr. Consultant – CIO/CISO Services Don’t wait for disaster to strike before you act
RkJQdWJsaXNoZXIy MTMzNDE=