Basic security: password management

Read the entire text once for understanding, then read it a second time and tick each bullet in the summary checklist as you confirm you understand and can apply the rule. Open your password manager (or install one if needed) and create at least three new strong passwords for real accounts before moving to the quiz. Keep the course open in a separate window during the quiz for quick factual verification.

In digital marketing you will manipulate files, access statistics platforms, pay for advertising space, configure automation services and communicate with many partners. Every one of these actions goes through accounts protected by passwords. A single weak or reused password can let a malicious person steal audiences, divert advertising budgets or destroy campaign data. Basic security therefore begins with a rock-solid personal and professional password policy. The following course gives you all the rules you need to adopt today.

Why passwords matter
A password is a secret code that proves your identity when no human being is available to recognise you. If the code leaks, the service considers the attacker to be you. Consequences in digital marketing include: lost access to the brand’s social networks, deletion of mailing lists, exposure of customer data, fraudulent invoices in advertising accounts, or blackmail based on stolen dashboards. In short, bad passwords directly threaten revenue, reputation and sometimes legal compliance with data-protection laws such as the General Data Protection Regulation of the European Union.

How attackers steal passwords
- Phishing: a fake email invites you to “verify” your account and records the code you type.
- Keylogging: malware installed via a malicious attachment records every key pressed.
- Database breach: the service itself is hacked and its list of password hashes is published online.
- Credential stuffing: attackers try leaked address–password pairs from one site on dozens of others, banking on reuse.
- Shoulder surfing: someone literally watches you type in a café or at an event.
Understanding these methods will help you build defences that block several at once.

What a strong password looks like
A modern strong password resists guessing by humans and automated programs. Minimum technical characteristics:
- Length: at least 12 characters for low-risk accounts, 16 or more for advertising platforms or email inboxes.
- Entropy: the amount of randomness should be high. Example of weak 12-character string: Summer2024!. Example of strong 12-character string: L6v$9hZpQ2fB.
- No personal references: never include first name, pet, birthday, brand you work for or easy keyboard patterns such as qwerty or azerty.
- Unique: used on one service only.
Because length is easier to remember than obscurity, a passphrase made of unrelated words can work: Orange-Bridge-Galaxy-54. Four random words plus a number and a dash reach about 20 characters while staying pronounceable.

Why reuse is dangerous – a concrete scenario
Imagine you create a Mailchimp account with the password Coucou31 and you also use Coucou31 for your customised Gmail address. Six months later a small e-commerce site where you registered to test their checkout is breached and Coucou31 is among the stolen hashes. Attackers test address+password pairs on Google. Your Gmail opens, they reset your Mailchimp and Facebook passwords through recovery emails, and all your campaigns stop within minutes. The domino effect began with a single reused password.

Password managers: the professional solution
A password manager is a digital safe that stores and encrypts all your credentials behind one master passphrase. Advantages are clear:
- Generates random 20+ character passwords automatically.
- Synchronises across computer, phone and tablet so you never copy passwords by email.
- Autofills only on the correct domain name, preventing most phishing.
- Warns you if a stored service appears in a public breach.
Popular free solutions for beginners include Bitwarden and the open-source version of KeePass. Paid options such as 1Password or Dashlane offer family or business dashboards, emergency access for a colleague and integrated two-factor authentication.

How to create your master passphrase
The master passphrase cannot go into the manager itself, so you must memorise it. Method 1: pick five random words from a paper list, for example “curtain glove bicycle walnut river” and add an easy-to-remember pattern like “/99”. You get curtainGloveBicycleWalnutRiver/99 which is more than 30 characters and contains upper- and lower-case letters plus a symbol and digits. Method 2: choose a line from a childhood song and keep only the first letter of each word, mixed with punctuation. “Old MacDonald had a farm E-I-E-I-O” becomes Omhafeieio=. Never write the master passphrase on a sticky note under your keyboard.

Two-factor authentication as an extra lock
Even the best password can be compromised once. Two-factor authentication, sometimes called multi-factor authentication, asks for a second proof: a one-time numerical code or a physical security key. For critical tools such as Google Workspace, Meta Business Suite or your advertising platforms, enable one of the following
- Time-based one-time passwords via an authenticator application like FreeOTP or Microsoft Authenticator.
- Short Message Service codes sent to your phone (least secure but still better than nothing).
- A hardware security key compatible with the FIDO2 standard like YubiKey.
Example: When you try to log in to Google Ads from an unknown device, the service requests the 6-digit code currently displayed in your authenticator app. An attacker with your password but without the phone cannot continue.

Corporate guidelines for agencies or freelance teams
Digital marketing work often involves several people sharing access to the same ass... (download to read the rest 👇)