4.6 Password Security

Question 1

Password complexity and length

Answer 1

• Make your password strong
  –Resist guessing or brute-force attack
• Increase password entropy
  –No single words, no obvious passwords
  –Mix upper and lower case, letters, and special characters
• Stronger passwords are commonly at least 8 characters
  –These requirements change as processing
  speed gets faster
  –Consider a phrase or set of words

Question 2

Password age and expiration

Answer 2

• Password age
  –How long since a password was modified
• Password expiration
  –Password works for a certain amount of time
  –30 days, 60 days, 90 days, etc.
  –After the expiration date, the password does not work
  –System remembers password history, requires
  unique passwords
• Critical systems might change more frequently
  –Every 15 days or every week

Question 3

Password managers

Answer 3

• Important to use different passwords for each account
  –Remembering all of them would be impractical
• Store all of your passwords in a single database
  –Encrypted, protected
  –Can include multifactor tokens
• Built-in to many operating systems
  –And some browsers
• Enterprise password managers
  –Centralized management and recovery options

Question 4

Passwordless authentication

Answer 4

• Many breaches are due to poor password control
  –Weak passwords, insecure implementation
• Authenticate without a password
  –This solves many password management issues
• You may already be passwordless
  –Facial recognition, security key, etc.
• Passwordless may not be the primary
  authentication method
  –Used with a password or additional factors

Question 5

Just-in-time permissions

Answer 5

• In many organizations, the IT team is assigned
  administrator/root elevated account rights
  –This would be a great account to attack
• Grant admin access for a limited time
  –No permanent administrator rights
  –The principle of least privilege
• A breached user account never has elevated rights
  –Narrow the scope of a breach
• Request access from a central clearinghouse
  –Grants or denies based on predefined security policies

Question 6

Password Vaulting

Answer 6

Primary credentials are stored in a password vault
–The vault controls who gets access to credentials

Question 7

Accounts are temporary

Answer 7

Just-in-time process creates a time-limited account
–Administrator receives ephemeral credentials
–Primary passwords are never released
–Credentials are used for one session then deleted