Mitigating Password Attacks
Password attacks can be easily mitigated through the implementation of cryptographic authentication or the use of OTPs. However, not all devices, applications, or hosts support those authentication methods. Therefore, you may need to mitigate password attacks by disabling accounts after a set number of failed attempts at authentication. This helps to reduce the attacker's number of chances to crack an account through a brute-force method. Brute-force attacks involve the attacker simply trying various passwords until they finally gain access to an account on the system. These methods can be manual or automated.Password Testing
Password testing involves the periodic attempt by administrators to crack account passwords. This is done by taking the password file and running it through a password-testing program such as LC4 (formerly known as L0phtCrack 4), Crack, or John the Ripper. These programs can apply case changes (change capitals letters to lowercase) and add nonalphanumeric characters to a list of known passwords. Although these tools may be seen as falling within the realm of the "black hat" community, they serve an essential purpose in identifying and correcting weak account passwords across systems.User Education
Users should be educated on the content of "strong" passwords. They should be counseled regarding their choice of passwords by reminding them that passwords should not be the name of something they own, a family member's name, or the name of a pet. Effective security policies contain a password policy that guides users in how to generate strong passwords. The following guidelines can be used to define strong passwords. Passwords should- Be at least eight characters in length
- Contain both upper- and lowercase characters
- Contain both alphanumeric and nonalphanumeric characters such as #, @, %, and $
Ideally, passwords are randomly generated. Unfortunately, those types of passwords are also the most difficult to remember, which leads users to write them down on paper, thereby creating additional risks. |
لطفا منتظر باشید ...
