These include those below.

Overview

Passwords should not be reused for multi systems in case of a breach in which a password is exposed by a bad actor.

Staff should create strong and memorable passwords e.g. three random words, e.g. ‘planeyellowbread’, although some systems will require additional complexity (e.g. capital letters, numbers or punctuation). Regular password change is not required unless the system demands. National Cyber Security Centre (NCSC), now recommends organisations do not force regular password expiry because they indicate that can increase the risk of workarounds. Read more: NCSC password information.

Password and access control policy and procedures

See: DSPTK Template 15 “Access control and password management procedures” and other data security templates at: psnc.org.uk/dstemplates.

Password tips

• Three random words: Three random words are recommended by NCSC although some systems will require additional complexity.
• Dictionary attacks: Avoid consecutive keyboard combinations— such as ‘qwerty’, ‘asdfg’, ‘123456’ or ‘111111’.
• Avoid using personal information within security questions: You may be able to set-up security questions and answers but be cautious of including any information available online or within your social media. This protects you from bad actors being able to take control of your account using the ‘forgotten password’ and ‘security questions’ options.
• Simple passwords: Do not use information such as your name, age, birth date, name of loved ones, pet’s name, or favourite colour/song, etc.
• Don’t reuse of passwords across multiple sites: Reusing passwords for multi accounts can lead to one breach of your credentials posing a greater threat.
• Make sure you use different passwords for each of your accounts.
• Be sure no one watches when you enter your password.
• Avoid entering passwords into computers you do not control (e.g. internet cafés or libraries)—they may ‘auto remember’ your password or even have malware that steals passwords.
• Avoid entering passwords when using unsecured Wi-Fi connections (e.g. airports or coffee shops)—hackers can intercept your passwords and data over this unsecured connection.
• Don’t tell anyone your password. Your trusted friend now might not be your friend in the future. Keep your passwords safe by keeping them to yourself.
• It’s okay to write down your passwords and keep these safe, just keep them away from your computer and mixed in with other numbers and letters so it’s not apparent that it’s a password.

Community Pharmacy IT Group (CP ITG) is in favour of smart authentication options which reduce the burden for health and care staff with logging into so many systems – e.g. NHS-related systems using ‘login with NHSmail’, NHS Identity, biometrics etc.

Password Managers may also be suitable for managing passwords for some systems. National Cyber Security Centre has provided guidance about Password Managers.

CP ITG helped to prepare a list of websites which pharmacy teams report requiring access to which demonstrates the multi-login burden: Website/system list which pharmacy teams access (pdf).