Info

Last Modified

6 months ago

Percent Complete

90%

Disclosure

Jan 01, 1999

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

Passwords are a cornerstone of computer security. Virtually every sensitive computer resource requires one or more passwords to access it in any context. Most virtual authentication methods are based on some form of password, or security token. Given that passwords are chosen by the user, who tends to pick words easily remembered, along with poor password implementation, weak passwords are a common method for network intrusion. Despite decades of reliance upon these passwords, systems still ship with no password, easily guessed passwords, or no mechanisms to force users to maintain strong passwords. This often leads to passwords that are weak and easy to compromise.

Classification

Location: Local Access Required, Remote/Network Access Required
Attack Type: Authentication Management
Impact: Loss of Confidentiality, Loss of Integrity, Loss of Availability
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Best Practice

Solution

While it is an accepted fact of security that any password can be guessed given sufficient resources, every organization should attempt to maintain strong passwords to deter and delay such compromises. The following measures can be taken to help in this process:

1. Passwords should be sufficiently complex:
a. Be at least eight characters in length
b. Contain upper case, lower case, and special characters
c. Not be a word in any language or found in any dictionary
d. Not bear any resemblence to the user, family, pets, etc.
2. Enforce password history. Ensure users must pick a new unique password and can not re-use old passwords.
3. Maximum password age. After a set amount of time (recommended 30 - 90 days), the password should expire and force users to select a new one.
4. Test password security by attempting to "crack" passwords. Only do so with written permission from a CEO/CSO/CxO.
5. Ensure users are educated on password security and the importance of passwords. This includes training on what not to do regarding passwords (ie: share them, write them down).