UNDERSTANDING SECURITY POLICIES

OBJECTIVES

• Using security policies to enhance security
• Understand password policies

PASSWORD INTRO

• Foundation of security is the protection of networks, systems and data
• Passwords secure everything: NEED STRONG PASSWORDS!!!
• Password policies force users to create strong passwords

PASSWORD INTRO

• Microsoft provides controls that allow you to control password creation
• Password complexity, account lockout, pw length, etc..

CERT READY?

COMPLEXITY TO MAKE STRONG PASSWORDS

• A complex password uses uppercase, lowercase, numerical and symbols
• Try not to use words in a dictionary, personal info, or easily guessable things
• Take a dictionary word and substitute some letters for characters
• Ex. c0mput3r

USING ACCOUNT LOCKOUT TO PREVENT HACKING

• Account lockout is when too many attempts are failed and locks the account
• The most common way to hack is to repeatedly guess passwords

PASSWORD LENGTH

• Length is more secure but harder to remember
• General minimum length is eight characters

USING GPO TO ENFORCE SECURITY

• A GPO are rules that allow admins to have control
• A GPO can be used to set password rules and regulations

UNDERSTANDING COMMON ATTACK METHODS

• Passwords have always been the weakest link
• Even strong passwords are vulnerable to attack

DICTIONARY & BRUTE ATTACKS

• Dictionary attack: uses a dictionary of common passwords
• Brute force: goes through every combo possible
• Both attacks work better when used on short passwords
• Account lockout feature really helps

PHYSICAL ATTACKS

• Keylogger: captures every stroke on a user's keyboard
• Hidden cameras
• Removal of hard drives

LEAKED AND SHARED PASSWORDS

• Co-workers often share passwords
• Family members, spouses, boyfriends and girlfriends share passwords

CRACKED PASSWORDS

• A password crack attack attempts to steal as many passwords
• Encrypted passwords are slightly more protected than plain or hashed

NETWORK AND WIRELESS SNIFFERS

• If attacker has access to network it can uses a sniffer
• Sniffer: software that capture network packets and display them
• Used to access to passwords sent over the network
• Sniffers can also be used to track keystrokes thru a wireless keyboard

GUESSED PASSWORDS

• Using personal info such as birthdays
• Pet names, street names make it easy to guess
• Usually only people who know a lot about the user will guess