Password Strength Policy Query


Published on

Description of how a password strength policy should include.

Published in: Technology
  • Be the first to comment

  • Be the first to like this

No Downloads
Total Views
On Slideshare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Password Strength Policy Query

  1. 1. Password Strength Policy Query General Terms and Common Definitions: Password A password is a secret word or string of characters that is used for user authentication to prove identity, or for access approval to gain access to a resource (example: an access code is a type of password). The term passcode is sometimes used when the secret information is purely numeric, such as the personal identification number (PIN) commonly used for ATM access and in our case used for authentication into the M-PIM application. Passwords are generally short enough to be easily memorized and typed. Password strength - Password strength is a measure of the effectiveness of a password in resisting guessing and brute-force attacks. In its usual form, it estimates how many trials an attacker who does not have direct access to the password would need, on average, to guess it correctly. The strength of a password is a function of length, complexity, and unpredictability.[1] Using strong passwords lowers overall risk of a security breach, but strong passwords do not replace the need for other effective security controls. The effectiveness of a password of a given strength is strongly determined by the design and implementation of the authentication system software, particularly how frequently password guesses can be tested by an attacker and how securely information on user passwords is stored and transmitted. Risks are also posed by several means of breaching computer security which are unrelated to password strength. Such means include wiretapping, phishing, keystroke logging, social engineering, dumpster diving, shoulder surfing, side-channel attacks, and software vulnerabilities. Password policy - A password policy is the guide to choosing satisfactory passwords, hard to be replayed or hacked. Although some are controversial they are usually intended to: assist users in choosing strong passwords ensure the passwords are suited to the target population recommendations to users with regard to the handling of their passwords a requirement to change any password which has been lost or compromised, and perhaps that no password be used longer than a limited time some policies prescribe the pattern of characters which passwords must contain - characters, digits, symbols, etc. For example, password expiration is often covered by password policies. Password expiration serves two purposes: if the time to crack a password is estimated to be 100 days, password expiration times fewer than 100
  2. 2. days may help ensure insufficient time for an attacker. if a password has been compromised, requiring it to be changed regularly should limit the access time for the attacker Some argue that password expiration have become obsoletesince: asking users to change passwords frequently encourages simple, weak passwords. if one has a truly strong password, there is little point in changing it. Changing passwords which are already strong introduces risk that the new password may be less strong. a compromised password is likely to be used immediately by an attacker to install a backdoor, often via privilege escalation. Once this is accomplished, password changes won't prevent future attacker access. mathematically it doesn't gain much security at all. Moving from never changing one's password to changing the password on every authenticate attempt (pass or fail attempts) only doubles the number of attempts the attacker must make on average before guessing the password in a brute force attack - one gains much more security just increasing the password length by one character than changing the password on every use. I. Security Standards Passwords are very important part of computer's security. They often serve as the first line of defense in preventing unauthorized access to computers and data. Because of the crucial role of passwords it is important to choose passwords that are complex and cryptic enough to prevent others from guessing them or from cracking them with programs,rainbow table or dictionary attack. At the same time, it is also important to keep passwords secret and secure so others cannot use them or find them. These standards are intended to provide information of guidance about how to create good, cryptic passwords and how to keep them secure and confidential. Password Strength and Security Standards or II. How to create good, cryptic, hard-to-guess-or-crack passwords. The following requirements are considered as essential and are mandatory and are enforced on many business, software or other web entities (sites). 1. Passwords must be at least 8 characters in length and contain at least 3 of the following 4 types of characters: lower case letters (i.e. a-z)
  3. 3. upper case letters (i.e. A-Z) numbers (i.e. 0-9) special characters (e.g. !@#$%^&*()_+|~-=‘{}[]:";’<>?,./) Passwords for systems or applications that cannot support the above standard must be longer -- at least 10 characters in length, if possible -- and incorporate the maximum complexity the system or application can support. 2. In addition, passwords must: Not be a word found in the dictionary (in any language), whether spelled forwards or backwards, or a word preceded or followed by a digit (e.g., secret1, 1secret) Not include user name or login name. Not be a common keyboard sequence, such as "qwerty89" or "abc123" Not be from examples you have seen in print, such as the ones on this page.
  4. 4. III. How to keep your password secret and secure - 1. Do not share your passwords with anyone else, or in any way publish them. 2. Avoid writing passwords down. Whenever possible, change passwords to something you can easily remember. One way to do this is to create a password from a familiar phrase (see Additional Tips and Hints for more information). Once you have a good, strong, memorable password, you can come up with a system to modify it slightly for each system or application. Then you only have to remember your base password and your system. If you have to write a password down, try to write it in a way that others won't be able to decypher -- such as using a hint for part of it -- and store it securely in a safe, unlikely-to-be-discovered location, e.g., not under the keyboard or on your monitor. Passwords can also be securely stored using a variety of free and low-cost "password vault-type" encryption tools. See #5 in this section for details. 3. If you think your password may have been compromised, notify the Support (Contact, Customer. Etc.) Center and/or your supervisor. 4. Change passwords provided for initial access or password resets as soon as possible. Information for doing this should be provided with the password. If it is not, contact the person or office issuing the password for instructions. 5. Don’t let your applications or browser remember/store passwords that provide access to restricted systems or data.
  5. 5. That way if someone gets access to your computer, they don’t also get access to all of your accounts. Passwords can be securely stored using a variety of free and low-cost "password vault-type" encryption tools including your computer's key-chain, LastPass, 1password, Password Wallet, PasswordSafe (PC)/( Mac), and KeePass (PC) / KeyPassX (Mac). Important notes: Master passwords providing access to these tools must meet the minimum strength and security standards stated in these Standards. For keychains, this is the password used to access the computer. Do not store passwords providing access to restricted data on service provider's websites, public computers, non-personal devices. 6. Use different passwords for accounts that provide access to restricted data than for your less-sensitive or personal accounts. For additional security, use a different password for each account that provides access to sensitive data; that way if one of your passwords is compromised, your others are still OK. 7. Ensure that passwords are transmitted securely. Before you log into something via the web, look for “https” (not http) in the URL to indicate that there is a secure connection. If this is missing, request a secure web page from the service provider that you can use to log in . Make sure that any applications you log into on your computer (such as email) are set for secure
  6. 6. authentication. Additional Tip and Hints: Longer passwords are better. Avoid including personal information, names of family, places, pets, birthdays, address, hobbies, license plate number, etc. Avoid words that are slang, dialect, jargon, etc. A password consisting of several words separated by spaces can actually be more secure and easier to remember than a more complicated, obscure one. Basing your password on a phrase that is familiar to you is one way to generate a password that is memorable to you, but obscure to others. For example, "The hills are alive with the sound of music!!" is actually a pretty good password, except for the fact that that it is inconveniently long and published here. A shorter version could be, “Hills! alive! Music!” or, using a variant on the first letter of each word, "ThRawts0m!". A few memorable, unrelated words can also be a good password, such as "correct horse battery staple" or, if the system requires additional complexity, “Correct horse battery staple!” Passwords shouldn't be too common (Password1 is very common. 2bor!2b is pretty common and is also only 7 characters in length).
  7. 7. Be aware that automatic "password cracker" programs check for common symbol substitutions in words, such as "0" for "o" and "$" for "s". Simply substituting common symbols for letters in a dictionary word, e.g. "Pa$$w0rd" instead of "Password," might result in a guessable password even though it technically meets the above requirements. (Passwords that are found vulnerable by automatic password strength checkers may be rejected). Microsoft's password strength checker is a handy tool to help gauge the strength of a password. examples: Weak strength password - AaSsDdG Medium strength password - cdxsza1126
  8. 8. Strong strength password - St@bleDog&Hum@N IV. Additional Requirements - 1. Passwords provided as initial passwords or password resets must meet the Minimum Password Requirements. ("Changeme", "admin", "pass1", "Passw0rd" and other common passwords found in password crackers should not be used.) Passwords provided as initial passwords or password resets also must not be a fixed password or a published/easy-to-figure-out formula that, if discovered, could be used to gain unauthorized access to a system or application. Passwords provided for initial access or password resets must be unique. 2. Ensure that end users are aware of the above password strength standards when it is not possible for applications and systems to enforce them technically. 3. Ensure secure transmission and storage of passwords. 4. Instruct users to change passwords provided for initial access or password resets as soon as possible after initial use and provide instructions for doing so. Alternatively, temporary passwords can be set to expire upon initial use. 5. Give users advance notice about password requirements so they can come up with well-thought-out, memorable passwords instead of spur-of-the-moment ones. 6. Passwords used for privileged access must not be the same as those used for non-privileged access. 7. Administrator-level access to restricted data, computers or networks must be able to identify the individual performing the access, e.g. via a unique user ID/password and elevated permissions as opposed to utilizing a shared admin or root account.
  9. 9. 8. Report potential password security compromises to the Support Center. 9. Service Providers should consider using Identity Management (IdM) Services (Shibboleth for example), for authentication to their applications. 10. Where possible and applicable, applications and systems must be configured to enforce there password complexity standards. 11. Passwords provided for initial access and password resets much be set to expire upon initial use, where feasible. 12. initial passwords must be set to expire after no more than 90 days and password resets must be set to expire after 6 to 12 hours when possible to prevent unauthorized account access. Note: This requirement is not intended to imply that passwords must expire periodically. It is, instead, intended to prevent the misuse of initial and temporary passwords. 13. Systems must be configured to prevent resubmission of previously used password within 12 months no less.