Commit 4a48163d5b
Unsigned
Layout: unified · split
content/blog/2019-01-07-useful-css.org +32 −31
| @@ -5,14 +5,15 @@ | |||
| 5 | 5 | ||
| 6 | * Introduction to CSS | 6 | * Introduction to CSS |
| 7 | 7 | ||
| 8 | [[https://en.wikipedia.org/wiki/CSS][CSS]], the language used to markup HTML code and make it "pretty", is one of the | 8 | Cascading Style Sheets ([[https://en.wikipedia.org/wiki/CSS][CSS]]), the language used to mark up HTML code and give it |
| 9 | most effective ways to increase the attractiveness of a website. It can also | 9 | a visual style, is one of the most effective ways to increase the attractiveness |
| 10 | lead to increased user engagement, retention, and satisfaction. In fact, there | 10 | of a website. It can also lead to increased user engagement, retention, and |
| 11 | are whole career fields are dedicated to the improvement of user experiences, | 11 | satisfaction. In fact, there are whole career fields dedicated to the |
| 12 | known as UI design and UX design. | 12 | improvement of user experiences, known as User Interface (UI) design and User |
| 13 | 13 | Experience (UX) design. | |
| 14 | Some web developers are used to the common CSS properties, such as element | 14 | |
| 15 | sizing, fonts, colors, etc., but are not as well versed in less-used properties | 15 | Some web developers are familiar with the common CSS properties, such as element |
| 16 | sizing, fonts, and colors, but are not as well versed in less-used properties | ||
| 16 | and values such as =flexbox=, =clip-path=, and =transform=. This article will | 17 | and values such as =flexbox=, =clip-path=, and =transform=. This article will |
| 17 | provide some insight into the less-used and unique CSS properties. | 18 | provide some insight into the less-used and unique CSS properties. |
| 18 | 19 | ||
| @@ -23,10 +24,10 @@ developers. CSS variables allow you to give your website a well-defined | |||
| 23 | structure, where you can easily reuse CSS properties throughout the project. | 24 | structure, where you can easily reuse CSS properties throughout the project. |
| 24 | 25 | ||
| 25 | You can use variables to define things, such as color palettes. Then, you can | 26 | You can use variables to define things, such as color palettes. Then, you can |
| 26 | use these colors for backgrounds anywhere else in the HTML. This could be | 27 | use these colors for backgrounds anywhere else in the HTML. You can expand this |
| 27 | extended, where extra variables could be defined for =primary-text=, | 28 | and define variables for =primary-text=, =quoted-text=, etc. You can also use |
| 28 | =quoted-text=, etc. Variables can also be used to define spacing (e.g. =32px= or | 29 | variables to define spacing (e.g. =32px= or =2rem=), which you can then apply to |
| 29 | =2rem=), which can then be applied to margins, padding, font sizes, and more. | 30 | margins, padding, font sizes, and more. |
| 30 | 31 | ||
| 31 | For example, here are some variables defined at the root of the website, which | 32 | For example, here are some variables defined at the root of the website, which |
| 32 | allows for any subsequent CSS rules to use those variables: | 33 | allows for any subsequent CSS rules to use those variables: |
| @@ -47,11 +48,11 @@ body { | |||
| 47 | 48 | ||
| 48 | Box shadows were once my mortal enemy. No matter how hard I tried, I just | 49 | Box shadows were once my mortal enemy. No matter how hard I tried, I just |
| 49 | couldn't get them to work how I wanted. Because of this, my favorite discovery | 50 | couldn't get them to work how I wanted. Because of this, my favorite discovery |
| 50 | has been CSSMatic's [[https://www.cssmatic.com/box-shadow][box shadow generator]]. It provides an excellent tool to | 51 | has been CSSMatic's [[https://www.cssmatic.com/box-shadow][box shadow generator]]. It provides a tool to generate box |
| 51 | generate box shadows using their simple sliders. Surprisingly, this is the | 52 | shadows using their simple sliders. Surprisingly, this is the reason I learned |
| 52 | reason I learned how box shadows work! You can use the sliders and watch how the | 53 | how box shadows work! You can use the sliders and watch how the CSS code changes |
| 53 | CSS code changes in the image that is displayed. Through this, you should | 54 | in the image that the tool displays. Through this, you should understand that |
| 54 | understand that the basic structure for box shadows is: | 55 | the basic structure for box shadows is: |
| 55 | 56 | ||
| 56 | #+begin_src css | 57 | #+begin_src css |
| 57 | box-shadow: inset horizontal vertical blur spread color; | 58 | box-shadow: inset horizontal vertical blur spread color; |
| @@ -118,19 +119,19 @@ with the code, experiment, and learn. | |||
| 118 | Try these box shadows out on your own and see how changing each shadow value | 119 | Try these box shadows out on your own and see how changing each shadow value |
| 119 | works. | 120 | works. |
| 120 | 121 | ||
| 121 | * CSS Flexbox | 122 | * CSS Flex Box |
| 122 | 123 | ||
| 123 | Now, let's move on to the best part of this article: flexbox. The flexbox is by | 124 | Now, let's move on to the best part of this article: flex box. The flex box is by |
| 124 | far my favorite new toy. I originally stumbled across this solution after | 125 | far my favorite new toy. I originally stumbled across this solution after |
| 125 | looking for more efficient ways of centering content horizontally AND | 126 | looking for more efficient ways of centering content horizontally AND |
| 126 | vertically. I had used a few hack-ish methods before, but flexbox throws those | 127 | vertically. I had used other methods before, but flex box throws those out the |
| 127 | out the window. The best part of it all is that flexbox is /dead simple/. | 128 | window. The best part of it all is that flex box is /dead simple/. |
| 128 | 129 | ||
| 129 | Flexbox pertains to the parent div of any element. You want the parent to be the | 130 | Flex Box pertains to the parent div of any element. You want the parent to be the |
| 130 | flexbox in which items are arranged to use the flex methods. It's easier to see | 131 | flex box and the children's behavior modified by the parent's attributes. It's |
| 131 | this in action that explained, so let's see an example. | 132 | easier to see this in action that explained, so let's see an example. |
| 132 | 133 | ||
| 133 | *Flexbox* | 134 | *Flex Box* |
| 134 | 135 | ||
| 135 | #+begin_src html | 136 | #+begin_src html |
| 136 | <div class="flex-examples"> | 137 | <div class="flex-examples"> |
| @@ -166,13 +167,13 @@ this in action that explained, so let's see an example. | |||
| 166 | You may notice that we no longer need to use the =top= property for the =h3= | 167 | You may notice that we no longer need to use the =top= property for the =h3= |
| 167 | elements in our code. This is because we set the display box to be a flex | 168 | elements in our code. This is because we set the display box to be a flex |
| 168 | container for the small boxes, AND we made the small boxes flex containers for | 169 | container for the small boxes, AND we made the small boxes flex containers for |
| 169 | their elements (the h3 tags). Flex boxes can be nested like this to center | 170 | their elements (the h3 tags). You can nest flex boxes to center content that is |
| 170 | content that is inside centered content. | 171 | inside centered content. |
| 171 | 172 | ||
| 172 | For the example above, we designated the =justify-content= property to be | 173 | For the example above, we designated the =justify-content= property to be |
| 173 | =flex-start= so that the boxes stack from the left side of the screen. This | 174 | =flex-start= so that the boxes stack from the left side of the screen. You can |
| 174 | property can be changed to =center= to make the boxes appear in the center of | 175 | change this property to =center= to make the boxes appear in the center of the |
| 175 | the screen. | 176 | screen. |
| 176 | 177 | ||
| 177 | For an interactive example, [[https://codepen.io/LandonSchropp/pen/KpzzGo][check out this CodePen]] from [[https://codepen.io/LandonSchropp/][LandonScropp]]. Resize the | 178 | For an interactive example, [[https://codepen.io/LandonSchropp/pen/KpzzGo][check out this CodePen]] from [[https://codepen.io/LandonSchropp/][LandonScropp]]. Resize the |
| 178 | window with dice to see how they collapse and re-align. | 179 | window with dice to see how they collapse and re-align. |
| @@ -180,4 +181,4 @@ window with dice to see how they collapse and re-align. | |||
| 180 | * Even More CSS | 181 | * Even More CSS |
| 181 | 182 | ||
| 182 | For more inspiration, you can visit [[https://www.codepen.io][CodePen]], [[https://dribbble.com][Dribbble]], or [[https://uimovement.com][UI Movement]] to browse | 183 | For more inspiration, you can visit [[https://www.codepen.io][CodePen]], [[https://dribbble.com][Dribbble]], or [[https://uimovement.com][UI Movement]] to browse |
| 183 | the collections of many amazing web designers. | 184 | the collections of amazing web designers. |
content/blog/2019-09-09-audit-analytics.org +32 −32
| @@ -23,8 +23,8 @@ fact, data analytics are only a small part of the process. | |||
| 23 | See *Figure 1* for a more accurate representation of where data analysis sits | 23 | See *Figure 1* for a more accurate representation of where data analysis sits |
| 24 | within the full process. This means that data analysis does not include querying | 24 | within the full process. This means that data analysis does not include querying |
| 25 | or extracting data, selecting samples, or performing audit tests. These steps | 25 | or extracting data, selecting samples, or performing audit tests. These steps |
| 26 | can be necessary for an audit (and may even be performed by the same | 26 | can be necessary for an audit (and the same associates may perform these steps), |
| 27 | associates), but they are not data analytics. | 27 | but they are not data analytics. |
| 28 | 28 | ||
| 29 | * Current Use of Analytics in Auditing | 29 | * Current Use of Analytics in Auditing |
| 30 | 30 | ||
| @@ -32,8 +32,8 @@ While data analysis has been an integral part of most businesses and departments | |||
| 32 | for the better part of the last century, only recently have internal audit | 32 | for the better part of the last century, only recently have internal audit |
| 33 | functions been adopting this practice. The internal audit function works | 33 | functions been adopting this practice. The internal audit function works |
| 34 | exclusively to provide assurance and consulting services to the business areas | 34 | exclusively to provide assurance and consulting services to the business areas |
| 35 | within the firm (except for internal auditing firms who are hired by different | 35 | within the firm (except for internal auditing firms hired by different companies |
| 36 | companies to perform their roles). | 36 | to perform their roles). |
| 37 | 37 | ||
| 38 | #+begin_quote | 38 | #+begin_quote |
| 39 | Internal Auditing helps an organization accomplish its objectives by bringing a | 39 | Internal Auditing helps an organization accomplish its objectives by bringing a |
| @@ -66,15 +66,15 @@ most common places to start is to research some data analysis models currently | |||
| 66 | available. For this post, we'll take a look at the DELTA model. You can take a | 66 | available. For this post, we'll take a look at the DELTA model. You can take a |
| 67 | look at *Figure 2* for a quick overview of the model. | 67 | look at *Figure 2* for a quick overview of the model. |
| 68 | 68 | ||
| 69 | The DELTA model sets a few guidelines for areas wanting to implement data | 69 | The DELTA model sets guidelines for areas wanting to implement data analytics so |
| 70 | analytics so that the results can be as comprehensive as possible: | 70 | that the results can be as comprehensive as possible: |
| 71 | 71 | ||
| 72 | - *Data*: Must be clean, accessible, and (usually) unique. | 72 | - *Data*: Must be clean, accessible, and (usually) unique. |
| 73 | - *Enterprise-Wide Focus*: Key data systems and analytical resources must be | 73 | - *Enterprise-Wide Focus*: Key data systems and analytical resources must be |
| 74 | available for use (by the Internal Audit Function). | 74 | available for use (by the Internal Audit Function). |
| 75 | - *Leaders*: Must promote a data analytics approach and show the value of | 75 | - *Leaders*: Must promote a data analytics approach and show the value of |
| 76 | analytical results. | 76 | analytical results. |
| 77 | - *Targets*: Must be set for key areas and risks that the analytics can be | 77 | - *Targets*: Must be defined for key areas and risks that the analytics can be |
| 78 | compared against (KPIs). | 78 | compared against (KPIs). |
| 79 | - *Analysts*: There must be auditors willing and able to perform data analytics | 79 | - *Analysts*: There must be auditors willing and able to perform data analytics |
| 80 | or else the system cannot be sustained. | 80 | or else the system cannot be sustained. |
| @@ -91,9 +91,9 @@ auditors can use data analytics to assess and report on these KPIs. This allows | |||
| 91 | the person performing the analytics the freedom to express opinions on the | 91 | the person performing the analytics the freedom to express opinions on the |
| 92 | results, whereas the results are ambiguous if no KPIs exist. | 92 | results, whereas the results are ambiguous if no KPIs exist. |
| 93 | 93 | ||
| 94 | It should be noted that tracking KPIs in the department can help ensure you have | 94 | Note that tracking KPIs in the department can help ensure you have a rigorous |
| 95 | a rigorous Quality Assurance and Improvement Program (QAIP) in accordance with | 95 | Quality Assurance and Improvement Program (QAIP) in accordance with some |
| 96 | some applicable standards, such as IPPF Standard 1300. | 96 | applicable standards, such as IPPF Standard 1300. |
| 97 | 97 | ||
| 98 | #+begin_quote | 98 | #+begin_quote |
| 99 | The chief audit executive must develop and maintain a quality assurance and | 99 | The chief audit executive must develop and maintain a quality assurance and |
| @@ -143,36 +143,36 @@ colleagues. | |||
| 143 | * Data Analysis Tools | 143 | * Data Analysis Tools |
| 144 | 144 | ||
| 145 | Finally, to be able to analyze and report on the data analysis, auditors need to | 145 | Finally, to be able to analyze and report on the data analysis, auditors need to |
| 146 | evaluate the tools at their disposal. There are many options available, but a | 146 | evaluate the tools at their disposal. There are options available, but the most |
| 147 | few of the most common ones can easily get the job done. For example, almost | 147 | common ones can easily get the job done. For example, almost every auditor |
| 148 | every auditor already has access to Microsoft Excel. Excel is more powerful than | 148 | already has access to Microsoft Excel. Excel is more powerful than most people |
| 149 | most people give it credit for and can accomplish a lot of basic statistics | 149 | give it credit for and can accomplish a lot of basic statistics without much |
| 150 | without much work. If you don't know a lot about statistics but still want to | 150 | work. If you don't know a lot about statistics but still want to see some of the |
| 151 | see some of the more basic results, Excel is a great option. | 151 | more basic results, Excel is a great option. |
| 152 | 152 | ||
| 153 | To perform more in-depth statistical analysis or to explore large datasets that | 153 | To perform more in-depth statistical analysis or to explore large datasets that |
| 154 | Excel cannot handle, auditors will need to explore other options. The big three | 154 | Excel cannot handle, auditors will need to explore other options. The big three |
| 155 | that have had a lot of success in recent years are Python, R, and ACL. ACL can | 155 | that have had a lot of success in recent years are Python, R, and ACL Analytics |
| 156 | be used as either a graphical tool (point and click) or as a scripting tool, | 156 | (ACL). You can use ACL as either a graphical tool (point and click) or as a |
| 157 | where the auditor must write the scripts manually. Python and the R-language are | 157 | scripting tool, where the auditor must write the scripts manually. Python and |
| 158 | solely scripting languages. | 158 | the R-language are solely scripting languages. |
| 159 | 159 | ||
| 160 | The general trend in the data analytics environment is that if the tool allows | 160 | The general trend in the data analytics environment is that if the tool allows |
| 161 | you to do everything by clicking buttons or dragging elements, you won't be able | 161 | you to do everything by clicking buttons or dragging elements, you won't be able |
| 162 | to fully utilize the analytics you need. The most robust solutions are created | 162 | to fully utilize the analytics you need. To create the most robust solutions, |
| 163 | by those who understand how to write the scripts manually. It should be noted | 163 | you should write the scripts manually. Note that as the utility of a tool |
| 164 | that as the utility of a tool increases, it usually means that the learning | 164 | increases, it usually means that the learning curve for that tool will also be |
| 165 | curve for that tool will also be higher. It will take auditors longer to learn | 165 | higher. It will take auditors longer to learn how to utilize Python, R, or ACL |
| 166 | how to utilize Python, R, or ACL versus learning how to utilize Excel. | 166 | versus learning how to utilize Excel. |
| 167 | 167 | ||
| 168 | * Visualization | 168 | * Visualization |
| 169 | 169 | ||
| 170 | Once an auditor has finally found the right data, KPIs, and tools, they must | 170 | Once an auditor has finally found the right data, KPIs, and tools, they must |
| 171 | report these results so that actions can be taken. Performing in-depth data | 171 | report these results so that readers of their results can take action. |
| 172 | analysis is only useful if the results are understood by the audiences of the | 172 | Performing in-depth data analysis is only useful if the audience can understand |
| 173 | data. The best way to create this understanding is to visualize the results of | 173 | the results. The best way to create this understanding is to visualize the |
| 174 | the data. Let's take a look at some of the best options to visualize and report | 174 | results of the data. Let's take a look at some of the best options to visualize |
| 175 | the results you've found. | 175 | and report the results you've found. |
| 176 | 176 | ||
| 177 | Some of the most popular commercial tools for visualization are Microsoft | 177 | Some of the most popular commercial tools for visualization are Microsoft |
| 178 | PowerBI and Tableau Desktop. However, other tools exist such as JMP, Plotly, | 178 | PowerBI and Tableau Desktop. However, other tools exist such as JMP, Plotly, |
| @@ -180,8 +180,8 @@ Qlikview, Alteryx, or D3. Some require commercial licenses while others are | |||
| 180 | simply free to use. For corporate data, you may want to make sure that the tool | 180 | simply free to use. For corporate data, you may want to make sure that the tool |
| 181 | does not communicate any of the data outside the company (such as cloud | 181 | does not communicate any of the data outside the company (such as cloud |
| 182 | storage). I won't be going into depth on any of these tools since visualization | 182 | storage). I won't be going into depth on any of these tools since visualization |
| 183 | is largely a subjective and creative experience, but remember to constantly | 183 | is a subjective and creative experience, but remember to constantly explore new |
| 184 | explore new options as you repeat the process. | 184 | options as you repeat the process. |
| 185 | 185 | ||
| 186 | Lastly, let's take a look at an example of data visualization. This example | 186 | Lastly, let's take a look at an example of data visualization. This example |
| 187 | comes from a [[https://talent.works/2018/03/28/the-science-of-the-job-search-part-iii-61-of-entry-level-jobs-require-3-years-of-experience/][blog post written by Kushal Chakrabarti]] in 2018 about the percent | 187 | comes from a [[https://talent.works/2018/03/28/the-science-of-the-job-search-part-iii-61-of-entry-level-jobs-require-3-years-of-experience/][blog post written by Kushal Chakrabarti]] in 2018 about the percent |
content/blog/2019-12-03-the-ansoff-matrix.org +16 −16
| @@ -50,8 +50,8 @@ Market development extends existing products into new markets in an attempt to | |||
| 50 | increase the number of buyers. One interesting way that Coca-Cola used this | 50 | increase the number of buyers. One interesting way that Coca-Cola used this |
| 51 | strategy comes from the stigma that Diet Coke is a woman's drink(2019). | 51 | strategy comes from the stigma that Diet Coke is a woman's drink(2019). |
| 52 | Coca-Cola introduced Coca-Cola Zero, which contained the same nutritional | 52 | Coca-Cola introduced Coca-Cola Zero, which contained the same nutritional |
| 53 | content as Diet Coke, but was packaged in a dark black can to appear more | 53 | content as Diet Coke, but the company packaged it in a dark black can to appear |
| 54 | "manly"(2019). | 54 | more "manly" (2019). |
| 55 | 55 | ||
| 56 | ** Product Development | 56 | ** Product Development |
| 57 | 57 | ||
| @@ -77,11 +77,11 @@ lines of business(2019). | |||
| 77 | Unrelated diversification is a diversification strategy that does not really | 77 | Unrelated diversification is a diversification strategy that does not really |
| 78 | relate to the firm's core business but still diversifies their business | 78 | relate to the firm's core business but still diversifies their business |
| 79 | portfolio. A good example of this would be a coffee company who has decided to | 79 | portfolio. A good example of this would be a coffee company who has decided to |
| 80 | enter the market for bicycle sales. The main purpose of this strategy is to an | 80 | enter the market for bicycle sales. The main purpose of this strategy is to a |
| 81 | extremely diverse company that will not go bankrupt if one market goes through | 81 | diverse company that will not go bankrupt if one market goes through difficult |
| 82 | difficult times. However, this requires a lot of independent skills and heavy | 82 | times. However, this requires a lot of independent skills and heavy investments |
| 83 | investments since the company most likely cannot easily transfer knowledge | 83 | since the company most likely cannot easily transfer knowledge between the |
| 84 | between the markets they compete in. | 84 | markets they compete in. |
| 85 | 85 | ||
| 86 | * Requirements for Success | 86 | * Requirements for Success |
| 87 | 87 | ||
| @@ -95,15 +95,15 @@ internal and external perspectives throughout the strategy formulation process. | |||
| 95 | One interesting probability is that companies will be using multiple strategic | 95 | One interesting probability is that companies will be using multiple strategic |
| 96 | planning and management frameworks at the same time. While this may sound like | 96 | planning and management frameworks at the same time. While this may sound like |
| 97 | it could crowd the management process, there are numerous reasons to do so. For | 97 | it could crowd the management process, there are numerous reasons to do so. For |
| 98 | example, the Ansoff Matrix and the Balanced Scorecard are relatively popular, | 98 | example, the Ansoff Matrix and the Balanced Scorecard are popular, and they |
| 99 | and they cover entirely different parts of a company's strategy. Using the | 99 | cover entirely different parts of a company's strategy. Using the results from |
| 100 | results from the Balanced Scorecard could inform a company of the potential | 100 | the Balanced Scorecard could inform a company of the potential product and |
| 101 | product and market demands, such as from customer or supplier survey results, to | 101 | market demands, such as from customer or supplier survey results, to help the |
| 102 | help the company determine which Ansoff Matrix strategy to pursue. However, a | 102 | company determine which Ansoff Matrix strategy to pursue. However, a combined |
| 103 | combined approach at this level would require mature frameworks and focused | 103 | approach at this level would require mature frameworks and focused managers who |
| 104 | managers who are able to strategize at a high level. | 104 | are able to strategize at a high level. |
| 105 | 105 | ||
| 106 | Lastly, it should be noted that the author of the Ansoff matrix, Igor Ansoff, | 106 | Lastly, please note that the author of the Ansoff matrix, Igor Ansoff, |
| 107 | often used the term [[https://en.wikipedia.org/wiki/Analysis_paralysis][paralysis by analysis]] to explain the mistake of companies | 107 | often used the term [[https://en.wikipedia.org/wiki/Analysis_paralysis][paralysis by analysis]] to explain the mistake of companies |
| 108 | who overuse analysis and spend too much time planning. Companies need to | 108 | who overuse analysis and spend too much time planning. Companies need to |
| 109 | understand the utility of a strategic management framework while ensuring that | 109 | understand the utility of a strategic management framework while ensuring that |
content/blog/2019-12-16-password-security.org +25 −25
| @@ -11,15 +11,15 @@ Information security, including passwords and identities, has become one of the | |||
| 11 | most important digital highlights of the last decade. With [[https://www.usatoday.com/story/money/2018/12/28/data-breaches-2018-billions-hit-growing-number-cyberattacks/2413411002/][billions of people | 11 | most important digital highlights of the last decade. With [[https://www.usatoday.com/story/money/2018/12/28/data-breaches-2018-billions-hit-growing-number-cyberattacks/2413411002/][billions of people |
| 12 | affected by data breaches each year]], there's a greater need to introduce strong | 12 | affected by data breaches each year]], there's a greater need to introduce strong |
| 13 | information security systems. If you think you've been part of a breach, or you | 13 | information security systems. If you think you've been part of a breach, or you |
| 14 | want to check and see, you can use [[https://haveibeenpwned.com/][Have I Been Pwned]] to see if your email has | 14 | want to check and see, you can use [[https://haveibeenpwned.com/][Have I Been Pwned]] to see if any public |
| 15 | been involved in any public breaches. Remember that there's a possibility that a | 15 | breaches have exposed your email(s). Remember that there's a possibility that a |
| 16 | company experienced a breach and did not report it to anyone. | 16 | company experienced a breach and did not report it to anyone. |
| 17 | 17 | ||
| 18 | ** How Do I Protect Myself? | 18 | ** How Do I Protect Myself? |
| 19 | 19 | ||
| 20 | The first place to start with any personal security check-up is to gather a list | 20 | The first place to start with any personal security check-up is to gather a list |
| 21 | of all the different websites, apps, or programs that require you to have login | 21 | of all the different websites, apps, or programs that require you to have login |
| 22 | credentials. Optionally, once you know where your information is being stored, | 22 | credentials. Optionally, once you know where you are storing your information, |
| 23 | you can sort the list from the most-important items such as banks or government | 23 | you can sort the list from the most-important items such as banks or government |
| 24 | logins to less important items such as your favorite meme site. You will want to | 24 | logins to less important items such as your favorite meme site. You will want to |
| 25 | ensure that your critical logins are secure before getting to the others. | 25 | ensure that your critical logins are secure before getting to the others. |
| @@ -36,34 +36,34 @@ Personally, I recommend using a [[https://en.wikipedia.org/wiki/Passphrase][pass | |||
| 36 | password. Instead of using a string of characters (whether random or simple), | 36 | password. Instead of using a string of characters (whether random or simple), |
| 37 | use a phrase and add in symbols and a number. For example, your vault password | 37 | use a phrase and add in symbols and a number. For example, your vault password |
| 38 | could be =Racing-Alphabet-Gourd-Parrot3=. Swap the symbols out for whichever | 38 | could be =Racing-Alphabet-Gourd-Parrot3=. Swap the symbols out for whichever |
| 39 | symbol you want, move the number around, and fine-tune the passphrase until you | 39 | symbol you want, move the number around, and fine-tune the pass phrase until you |
| 40 | are confident that you can remember it whenever necessary. | 40 | are confident that you can remember it whenever necessary. |
| 41 | 41 | ||
| 42 | Once you've stored your passwords, make sure you continually check up on your | 42 | Once you've stored your passwords, make sure you continually check up on your |
| 43 | account and make sure you aren't following bad password practices. Krebs on | 43 | account and make sure you aren't following bad password practices. Krebs on |
| 44 | Security has a great [[https://krebsonsecurity.com/password-dos-and-donts/][blog post on password recommendations]]. Any time that a data | 44 | Security has a great [[https://krebsonsecurity.com/password-dos-and-donts/][blog post on password recommendations]]. Any time that a data |
| 45 | breach happens, make sure you check to see if you were included, and if you need | 45 | breach happens, make sure you check to see if the breach exposed your email, and |
| 46 | to reset any account passwords. | 46 | if you need to reset any account passwords. |
| 47 | 47 | ||
| 48 | * Developers | 48 | * Developers |
| 49 | 49 | ||
| 50 | ** What Are the Basic Requirements? | 50 | ** What Are the Basic Requirements? |
| 51 | 51 | ||
| 52 | When developing any password-protected application, there are a few basic rules | 52 | When developing any password-protected application, there are basic rules that |
| 53 | that anyone should follow even if they do not follow any official guidelines | 53 | anyone should follow even if they do not follow any official guidelines such as |
| 54 | such as NIST. The foremost practice is to require users to use passwords that | 54 | NIST. The foremost practice is to require users to use passwords that are at |
| 55 | are at least 8 characters and cannot easily be guessed. This sounds extremely | 55 | least 8 characters and bad actors cannot easily guess them. This sounds simple, |
| 56 | simple, but it requires quite a few different strategies. First, the application | 56 | but it requires different strategies. First, the application should check the |
| 57 | should check the potential passwords against a dictionary of insecure passwords | 57 | potential passwords against a dictionary of insecure passwords such =password=, |
| 58 | such =password=, =1234abc=, or =application_name=. | 58 | =1234abc=, or =application_name=. |
| 59 | 59 | ||
| 60 | Next, the application should offer guidance on the strength of passwords being | 60 | Next, the application should offer guidance on the strength of passwords you |
| 61 | entered during enrollment. Further, NIST officially recommends *not* | 61 | enter during enrollment. Further, NIST officially recommends *not* implementing |
| 62 | implementing any composition rules that make passwords hard to remember (e.g. | 62 | any composition rules that make passwords hard to remember (e.g. passwords with |
| 63 | passwords with letters, numbers, and special characters) and instead encouraging | 63 | letters, numbers, and special characters) and instead encouraging the use of |
| 64 | the use of long pass phrases which can include spaces. It should be noted that | 64 | long pass phrases which can include spaces. Note that to be able to keep spaces |
| 65 | to be able to keep spaces within passwords, all unicode characters should be | 65 | within passwords, you should support all unicode characters, and you should not |
| 66 | supported, and passwords should not be truncated. | 66 | truncate spaces. |
| 67 | 67 | ||
| 68 | ** What Does NIST Recommend? | 68 | ** What Does NIST Recommend? |
| 69 | 69 | ||
| @@ -87,17 +87,17 @@ NIST offers a lot of guidance on passwords, but I'm going to highlight just a | |||
| 87 | few of the important factors: | 87 | few of the important factors: |
| 88 | 88 | ||
| 89 | - Require passwords to be a minimum of 8 characters (6 characters if randomly | 89 | - Require passwords to be a minimum of 8 characters (6 characters if randomly |
| 90 | generated and be generated using an approved random bit generator). | 90 | generated and generate using an approved random bit generator). |
| 91 | - Compare potential passwords against a list that contains values known to be | 91 | - Compare potential passwords against a list that contains values known to be |
| 92 | commonly-used, expected, or compromised. | 92 | commonly-used, expected, or compromised. |
| 93 | - Offer guidance on password strength, such as a strength meter. | 93 | - Offer guidance on password strength, such as a strength meter. |
| 94 | - Implement a rate-limiting mechanism to limit the number of failed | 94 | - Implement a rate-limiting mechanism to limit the number of failed |
| 95 | authentication attempts for each user account. | 95 | authentication attempts for each user account. |
| 96 | - Do not require composition rules for passwords and do not require passwords to | 96 | - Do not require composition rules for passwords and do not require users to |
| 97 | be changed periodically (unless compromised). | 97 | change their passwords periodically (unless compromised). |
| 98 | - Allow pasting of user identification and passwords to facilitate the use of | 98 | - Allow pasting of user identification and passwords to facilitate the use of |
| 99 | password managers. | 99 | password managers. |
| 100 | - Allow users to view the password as it is being entered. | 100 | - Allow users to view the password as they type. |
| 101 | - Use secure forms of communication and storage, including salting and hashing | 101 | - Use secure forms of communication and storage, including salting and hashing |
| 102 | passwords using a one-way key derivation function. | 102 | passwords using a one-way key derivation function. |
| 103 | 103 | ||