14

Feb

Secure your PASSWORD

by: Zarex dela Cruz, CISSP, CISA on Saturday, February 14, 2009 12:19 PM
 

PASSWORD MANAGEMENT

One of the overlooked area many of us struggle with is password management. In our day to day computing activities, many of us would simply just use or chose to protect our assets with a simple password. These assets could be critical such as bank accounts, confidential data, or even health information. We are lacking the real work on password management.

passwordNow, just what is password management really is? Well, in its very simplest form, managing passwords!

In corporate world, there are various technologies that does password management. In fact, password management is covered in a good scope on many of books for the CISSP exam.

Now, before going deeper to it, let’s magnify our glass to the word password itself. Many, if not all of us know what password is. That’s the word you write on your sticky note and hide it underneath your keyboard. Kidding aside.

Password is the most widely and commonly used authentication mechanism. They are also considered the weakest security mechanism. Users would simply choose very easy passwords such as their date of birth, favorite color, their nickname, etc., that are easy enough to guess. Sometimes too, they give it away to their buddies or best friends.

It is funny yet interesting to see how users typically thinks security is not one of the most important part of their computer. Not until someone hacks into their computer or account, then that’s when security is all the frustrations.

So here comes password management to the rescue. Although the scope of this article will dive only deeper to day-to-day users of computers, emails and services; it will touch a bit on the corporate world where I will cover some of the best ways in managing password. Bear in mind, this article does not go deeper in how to implement SSO technologies or token devices and such.

Simply put, you got to protect your treasured belongings with your best security. You wouldn’t really want to put your jewelries, money, and other important belongings into a carton box just lying around your doorstep. The same would you need to protect your emails, your computers, your accounts with a good password.

A good password is at least eight characters and contains a combination of upper and lower case and special characters. Try to choose something not closely related to you, such as your color, pet name, or belongings. An example would be “1Fo126iveYoU” is a strong password. “blue123”, while it contains letters and numbers, it is still vulnerable to dictionary and brute-force attacks. I am not going to explain those but in short, those are types of attacks a hacker can use to guess your password. There are many free and easy to use programs out there that can easily do the guessing.

Also, not writing your password where someone can read or see is a good countermeasure to remember. Sometimes, we often change our password similar to previous one but incrementing or decrementing other characters. Such as “PassWord1” is your previous and “PassWord2” is your new. If you wrote it down in a piece of paper and throw it away, an attacker can go to the trash bin and try to find them. This technique is also called Dumpster Diving. So be aware, not because you are done with your password doesn’t mean they still cannot use it to guess your other passwords.

There are systems nowadays that will ask you for phrase instead of a password. These are called passphrase. So instead of entering “password 123”, you might be asked to key in “let me in this is me”. Also other systems do a different way by allowing you to enter cognitive password. Cognitive password are opinion- or fact-based information. These are usually derived by answering questions related about your life. The answers are then transposed to a virtual password.

In systems where we are only required to put our password, it is your duty to secure it. I’ve covered few ways to secure your password here but there are other many ways you can do on your own. Something I did not cover which is beyond the scope of this article is the implementation of encryption or token device to ensure that the password of user are not sniffed, eavesdropped, or captured by attacker for a replay-attack. These countermeasures are for security professionals to implement technical or logical controls in their enterprise.

The use of password synchronization, assisted password reset, and self-service password reset are few approaches you can implement in your enterprise to assist users reset their password and not being compromised during resets. Those are the real “password management” discussion.

As end users, protect your password as if it is the key to all your belongings. Remember, attackers can sniff them (so corporate should implement encryption), can brute-force guess them (apply hard-to-guess strong password), or they can steal them (using techniques such as dumpster diving, shoulder surfing, keyboard monitoring). Shoulder surfing is when someone is looking over your shoulder or back as you type in your password.

Next time, I will try to cover in details some of these attacks that you really need to be aware of.

6 Responses to Secure your PASSWORD

  1. Zarex dela Cruz says:

    July 14th, 2009 at 1:22 PM

    One of the countermeasure I failed to include for security professionals in their corporate world is the implementation of “clipping level”, where you set the threshold for invalid failed login attempts. This will counter any dictionary or brute-force attacks. On the contrary, accounts that exceeds these thresholds set will disable their account, which is an availability issue. Something you need to look into.

  2. Petrie P. says:

    July 19th, 2009 at 10:45 AM

    Thanks for this. It’s informative.

  3. Angel says:

    February 14th, 2010 at 12:19 PM

    Any kind of passwords, no matter how complex it is [with alpha, alpha numeric, alpha number + special characters] it can be cracked using brute force technique. So what would be your best advise to protect the passwords – Is resetting pwd frequently the only solution or what according to you is the best ?

  4. Rex says:

    February 17th, 2010 at 12:38 PM

    Very true, all passwords will eventually be cracked. It is just a matter of time. So the password itself is no longer what we need to focus on now. But “time”. The more complicated it is, the longer it will take for someone to crack it. Resetting or changing it often is a very good practice. This is also “time” driven as you are giving the cracker no time to figure out the correct password. Tokens are very good complements of passwords. Using a time- or challenged-based tokens appended to your existing password makes it harder for the password to be cracked. Because even though they have figured out your actual password, if they don’t have the token to generate additional randomness, it is still an invalid password to the system.

  5. Angel says:

    February 20th, 2010 at 6:43 AM

    Thank you.. That’s good !

  6. Amy Spitzfaden-Both says:

    July 17th, 2014 at 10:14 AM

    Hi,

    I looked for an email address but couldn’t find one. My name is Amy Spitzfaden-Both and I’m working with PortalGuard. We’re in the field of internet security, and we’re beginning to develop relationships with respected content creators. Our focuses include self service password reset education, two factor authentication education, and single sign-on education. Would you be interested in having us post a guest blog and perhaps featuring a guest blog from you as well? You can out more about us and what we’re trying to do on our site: http://www.portalguard.com/student-portal-login.html. I look forward to hearing from you.

    Amy

Leave a comment