Password Policy Implemantation

INFORSECFAMILY 2012
WHY DO WE STIL NEED TO IMPLEMENT STRONG PASSWORD POLICY

Password is a combination of characters which is used to verify that a particular user is requesting access to a certain files is really whom he say he is .This definition does not specify what kind of characters the user need to use in order to create a secure password, which means password from the beginning was not created with security in mind but rather it just made with assumption that if you have a password you are secure and it does not matter what kind of password you have and length, alpha-numeric was not a concern during the old days. This why Lot of organisations do not have password policy implementation problems, most of system administrators these days just specify the length of password but we fail to implement alpha-numeric password policy in our organisations and that why our users uses a very simple passwords. Before we proceed any further lets talk about common password attacks. I. Just ask: You may not believe it but the simplest way of cracking password is by asking for the password. In this situation an attack use social engineering methodology and most of time user will provide information to the attack without any hesitations. Remember most of people always give their passwords to their family members, work mates and friends so if you create a very good lie, for sure you will get that password. Password Guessing: because most of users are just tired of so many pins and passwords they have to remember they dont use something they cant remember. In todays lifestyle we need to enter password or pin almost in all application .This creates a vulnerability where a user will use a very simple password such as mobile number, names ,birth dates which makes it very easy for the attacker to be success in password guessing attack Rainbow tables: is a precompiled table for reversing cryptographic hash functions which is used for password cracking. These days hackers are computing all possible passwords and their hashes in a given system then put the results into a table, when he extracts a hash file from a system, he will simply go to rainbow table and look for plaintext which matches the hash file. Password Sniffing: an attacker can sniff authentication traffic between a client and the server and extract password hashes and this will be enough to begin cracking password, this can be done by tools like Cain& Abel and other few tools. Password Capturing: most of attackers capture passwords by just installing keyboard loggers which be done through installing hardware or software programme and its very easy to do this kind of attack, we all know that users like to click links on their mails.
II.
III.
IV.
V.
The following are tips on how to defender against password attacks: I. Try to avoid the following: Numeric or words only: this makes it easy for the attacker to crack this passwords and he wont take long time to crack it. Do not use your own name or pet name or dictionary words: Never write down your password either 1 DAVID MOGAPI +267 74303410 | INFORSECFAMILY
INFORSECFAMILY 2012
Never use your personal information Never use a single password in all application or computer accounts Make sure that you have a long password, combination of small and capital letters, numbers and special characters i.e. P@$$w0rd Replace some characters with numbers which are easily associated with. Always add at least a single special character in your password You can choose a dictionary word and totally change it into a very strong password by reversing the word and changing letters into numbers and special characters You can also separate each character with a number or special character
II. III. IV. V. VI.
One can ask what kind of solution do we have in order to defend our systems from these kinds of attacks , since we all know that users will never have follow your advice. I will say its very simple if you think about it but hey lot of systems administrators gave up said 8 characters and i dont care whatever you are going to use to make your password. This is due to a very simple thing people dont like to remember anything and one thing for sure a human mind will easily remember less than five strong passwords but above that just forget about it. The following are just a few you may want to look into if you are Systems Administrator: I. Proper Password policy: include the following in your policy: Enforce Password history Specify minimum and maximum password age Specify minimum password length Make sure that your passwords meet complexity requirements Choosing Passwords Password enforcement Administration passwords should be protected very careful and make sure that you do not have many administrative accounts in your system, also make sure that your servers do not have the same passwords
II.
If you do not like password policy complication biometrics is your best choice.
DAVID MOGAPI +267 74303410 | INFORSECFAMILY

Password Policy Implemantation

Uploaded by

Copyright:

Available Formats

Password Policy Implemantation

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Password Policy Implemantation

Uploaded by

Copyright:

Available Formats

INFORSECFAMILY 2012

WHY DO WE STIL NEED TO IMPLEMENT STRONG PASSWORD POLICY

II. III. IV. V. VI.

DAVID MOGAPI +267 74303410 | INFORSECFAMILY

You might also like