Microsoft Windows Password Authentication Security Point of Failure
Local Access Required,
Remote / Network Access
Loss of Confidentiality,
Loss of Integrity,
Loss of Availability
Passwords are a cornerstone of computer security. Virtually every sensitive computer resource requires one or more passwords to access it in any context. Most virtual authentication methods are based on some form of password, or security token. Given that passwords are chosen by the user, who tends to pick words easily remembered, along with poor password implementation, weak passwords are a common method for network intrusion. Despite decades of reliance upon these passwords, systems still ship with no password, easily guessed passwords, or no mechanisms to force users to maintain strong passwords. This often leads to passwords that are weak and easy to compromise.
While it is an accepted fact of security that any password can be guessed given sufficient resources, every organization should attempt to maintain strong passwords to deter and delay such compromises. The following measures can be taken to help in this process:
1. Passwords should be sufficiently complex:
a. Be at least eight characters in length
b. Contain upper case, lower case, and special characters
c. Not be a word in any language or found in any dictionary
d. Not bear any resemblence to the user, family, pets, etc.
2. Enforce password history. Ensure users must pick a new unique password and can not re-use old passwords.
3. Maximum password age. After a set amount of time (recommended 30 - 90 days), the password should expire and force users to select a new one.
4. Test password security by attempting to "crack" passwords. Only do so with written permission from a CEO/CSO/CxO.
5. Ensure users are educated on password security and the importance of passwords. This includes training on what not to do regarding passwords (ie: share them, write them down).