RE: Minimum password requirements

From: dave kleiman (dave_at_isecureu.com)
Date: 07/20/04

  • Next message: phillip gay: "RE: Restricting users fron installing" 
    To: <gillettdavid@fhda.edu>, "'Randall M Gunning'" <securityfocus@randygunning.com>, <security-basics@securityfocus.com>
Date: Mon, 19 Jul 2004 22:37:12 -0400

    Dave,

    Absolutely it is otherwise the user could just change his password 10 times
    back to the original one. We generally use 3-5 days but 14 is fine.

    If your all your systems can support it you should try incorporating ALT
    characters into your policy it least for Admin and Extended access users.

    ______________________________________
    Dave Kleiman, CISSP, CISM, CIFI, MCSE
    www.SecurityBreachResponse.com

    -----Original Message-----
    From: David Gillett [mailto:gillettdavid@fhda.edu]
    Sent: Monday, July 19, 2004 11:47
    To: 'Randall M Gunning'; security-basics@securityfocus.com
    Subject: RE: Minimum password requirements

    > b. Passwords cannot be changed for at least 14 days.

      With the last 10 being retained, I don't think this one is necessary. And
    since it could prevent a leaked/compromised password from being changed, I'd
    say it risks decreasing security rather than improving it.

      Also, I don't see anything here which specifies the length or content of
    passwords, which directly determine how vulnerable they are to cracking. Or
    what about not writing them on a post-it stuck to a corner of the screen?

    David Gillett

    > -----Original Message-----
    > From: Randall M Gunning [mailto:securityfocus@randygunning.com]
    > Sent: Thursday, July 15, 2004 8:27 AM
    > To: security-basics@securityfocus.com
    > Subject: Minimum password requirements
    >
    >
    > I am working on implementing some minimum standards for our
    > department. I am wondering what the list thinks of these standards:
    >
    > a. Passwords must be changed at least every 90 days.
    > b. Passwords cannot be changed for at least 14 days.
    > c. Previous passwords cannot be reused (at least the last 10).
    > d. User ids and passwords are "owned" by an individual and must not be
    > shared with others.
    > e. User accounts that have not been accessed (i.e. logged in
    > to) for 30 days
    > will be deactivated.
    > f. Inactive user accounts will be deleted after 14 days.
    >
    > The numbers I have used are what I used in the corporate world for
    > systems that had no special security requirements (i.e. they did not
    > have any confidential data on them). What are other people doing for
    > this type of standard, if anything? Also, if you had your choice (not
    > subject to a committee agreeing), what would you choose for these
    > items?
    >
    > Please let me know if you have any questions.
    >
    > Thanks,
    >
    > Randy
    >
    >
    >
    >
    > --------------------------------------------------------------
    > -------------
    > Ethical Hacking at the InfoSec Institute. Mention this ad and get $545
    > off any course! All of our class sizes are guaranteed to be 10
    > students or less to facilitate one-on-one interaction with one of our
    > expert instructors.
    > Attend a course taught by an expert instructor with years of
    > in-the-field pen testing experience in our state of the art hacking
    > lab.
    > Master the skills
    > of an Ethical Hacker to better assess the security of your
    > organization.
    > Visit us at:
    > http://www.infosecinstitute.com/courses/ethical_hacking_training.html
    > --------------------------------------------------------------
    > --------------
    >

    ---------------------------------------------------------------------------
    Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
    any course! All of our class sizes are guaranteed to be 10 students or less
    to facilitate one-on-one interaction with one of our expert instructors.
    Attend a course taught by an expert instructor with years of in-the-field
    pen testing experience in our state of the art hacking lab. Master the
    skills of an Ethical Hacker to better assess the security of your
    organization.
    Visit us at:
    http://www.infosecinstitute.com/courses/ethical_hacking_training.html
    ----------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
    any course! All of our class sizes are guaranteed to be 10 students or less
    to facilitate one-on-one interaction with one of our expert instructors.
    Attend a course taught by an expert instructor with years of in-the-field
    pen testing experience in our state of the art hacking lab. Master the skills
    of an Ethical Hacker to better assess the security of your organization.
    Visit us at:
    http://www.infosecinstitute.com/courses/ethical_hacking_training.html
    ----------------------------------------------------------------------------

  • Next message: phillip gay: "RE: Restricting users fron installing"

    Relevant Pages

    • Windows SUS
      ... You can read the solution in paragraph Deploying the Automatic Updates Client on doc document here: ... > Ethical Hacking at the InfoSec Institute. ... > expert instructors. ... > Attend a course taught by an expert instructor with years of ...
      (Security-Basics)
    • RE: Windows SUS
      ... I had done all that and the SUS is running on client as expected. ... > Ethical Hacking at the InfoSec Institute. ... > expert instructors. ... > Attend a course taught by an expert instructor with years of ...
      (Security-Basics)
    • RE: Network spyware detection
      ... > Ethical Hacking at the InfoSec Institute. ... > expert instructors. ... > Attend a course taught by an expert instructor with ... > pen testing experience in our state of the art ...
      (Security-Basics)
    • RE: Removing Local Admin Rights...
      ... Ethical Hacking at the InfoSec Institute. ... to facilitate one-on-one interaction with one of our expert instructors. ... Attend a course taught by an expert instructor with years of in-the-field ... pen testing experience in our state of the art hacking lab. ...
      (Security-Basics)
    • RE: fax software in the domain
      ... You could add an extra layer of security by changing by connecting the ... Ethical Hacking at the InfoSec Institute. ... Attend a course taught by an expert instructor with years of ...
      (Security-Basics)