Susan Bradley writes today in CSOonline about ways to improve your password hygiene, especially if you are using a VPN to connect to your corporate network. I am horrified to report that I am guilty of doing Bad Things according to Bradley, and what is worse, that I should know better. Let’s review her suggestions:

First, one of the common attacks is taking advantage of password fatigue, whereby someone can gain access to your accounts by trying to figure out your password that was published on the dark web. She writes: “Too many people merely add a letter to a password rather than choosing a better passphrase.” That hand going up in the front of the room is my own. There is no excuse for it — I have a password manager that can make my passwords as complex as need be. Sometimes I add a character in the middle of my previous password. Far better to use multi-factor authentication, she says. I would agree with her, but many of the hundreds of my logins don’t support MFA. That is another travesty, to be sure. But color me lazy.

Another no-no is defending your login by looking for what is called “impossible travel” — whereby your login happens in one place, and your credentials are used in another place halfway across the planet shortly thereafter. VPNs check for this using location tracking. Wait, I thought this was good practice? Not any more: Bradley says this offers a false sense of security and we shouldn’t rely on geolocation blocking. Attackers have figured out ways around the blocks or obscure their locations.

Finally, she offers this wisdom: “It doesn’t hurt to reevaluate your current VPN platforms and consider alternatives such as managed-cloud VPN solutions, bearing in mind that MFA should be mandatory on all accounts.”

Bradley also runs AskWoody, another excellent resource.