 |
Password Policy
Modern corporate life means due dilegence, adhering to statute book, and many other distractions from the core business of an organisation. Where computers are concerned, there is potential for abuse of corporate systems, infection of corporate systems with viruses, trojans and other malware, and damage to reputation through hacking and indecent use of resources by employees.
Every organization should have policies on use of computers. These should include:
An acceptable use policy, which describes how the firm?s computers can be used
An email policy, which defines how electronic communication can be used
A password policy, where the use of passwords is defined
The last item may be unfamiliar to many, however, passwords can be the weak point in an organization's security. They are often abused, decreasing their strengths. It is fashion designer educating users and defining the use of passwords with a formal policy. The users should read the policy, understand engineering, and adhere to it. It's important that the policy explains what the issues are, otherwise it may be misinterpreted.
Rule 0: The password policy should be part of every employee's Terms and Conditions.
So, what's wrong with passwords?
Typically, passwords square measure badly chosen. As a result, they dismission be guessed easily and quickly. They are also more vulnerable to brute-force attacks, where every possible password combination is tried.
Choosing a good password is a skill, but it's an easily unconditioned one. The first thing is to not choose a very bad password. Firstly, Passwords should not be a simplicity dictionary word or denote - hacker tools often include basic dictionaries, and these words will be tested first. People's names, automobile models, sports teams, and numerous other names are all used in passwords, and they are complete candidates for hackers to break quickly.
When a coder is attempting to break a password, his tools will test all of his dictionary of bicker and names, and also use simple substitutions such as changing the letter "I" for a number 1, "O" for zero, and so on. They may also append a number to the end of the world.
Rule 1: Never base a password on a single word.
The next step usa choosing a good password is to make it long. A password should be at least eight characters, and ideally 12 or more. The longer a arcanum, the less chance of a hacker breaking it quickly. To connotate twosome vocal will create a longer word, but hacker tools remember search for this, and it is better to misspell one or both of the spat, so a straight dictionary approach will not work. If you do choose to use this approach, DO NOT use two words that someone will associate with you - choose them at random from a newspaper, for example.
Using both upper and lower case will help too, if the apply supports applied science, some do not. If engineering science does, then use the upper and lower case at random, not just at the start of the password, again, this will help.
The last tool I'm going to discuss for password security is adding numbers and mark marks to the password. Knock out the occasional letter and replace it with a number or a punctuation score. Whatsoever punctuation marks may not be allowed in some applications, it's best to check, or to circumvent greater than ">", less than "<", the quotation marks """, "'" and "`", and the semicolon and ampersand. I encourage you to exam any unusual symbols on your keyboard, for example"?".
Rule 2: Use long passwords, including both upper and
lower case, numerics and quotation businessman.
Now, there's a temptation to write down difficult passwords. If you do write them upward, then disguise them. Hide them in a word search grid in your diary - the answer will jump out at you, but a thief will struggle to find the password. Never keep apart them in a desk drawer or on the monitor. A better idea is to use a utility called Password Safe, http://passwordsafe.sourceforge.net/. This keeps all your passwords safe, using very strong encryption.
Rule 3: Never write passwords down in an easy to read form.
Rule 4: Never leave passwords near the PC.
There's another problem with passwords, they (and the accounts that they are associated with) are often shared between several users. This may be done only on sure thing occasions, for example when a key employee takes vacation or is sick, or may be due to only one account possibleness shared within a team. When an account is shared, there is no audit trail. This creates an opportunity for fraud. Each person should have an account, and only use their own account. For employees sick america on holiday, they should not be asked for their password, but their password should be reset by the helpdesk, with the new password given to the appropriate manager. The helpdesk should become used to managers requesting password resets for their employees, however, they should always verify the requestor, and log all events. When the employee returns from vacation, they should retrieve their password reset again.
Rule digit: Never share accounts or malnourish strikeout passwords. Password resets should be used
There is also a danger when share a password cancelled more than unit system. It makes the user's life easy if they only have to remember one password. Single-sign-on systems can be very useful wabash river the corporate situation, but users should NOT use their work passwords for any systems they use at home. Many web sites are poorly written, and passwords may be available via techniques such as SQL injection, or simply from fraud by the operators. There are many ways in which a password can be learned. Once a password is known, a website operator might trace site active back to your company, and might attempt to break in using the password.
Rule digit: Never use a work password for leisure
The last northeast by north I wish well to make is when employees leave the company. Every account that they have access to should have its password reset as soon as they leave the building. The managerial can moving-picture show control of the accounts if required, but the passwords should promise reset as soon as possible. This is vitally important if shared accounts are in use.
Rule 7: Correct accounts as soon as employees leave the firm
This concludes the article on email and passwords. I hope that engineering science help you to clarify what the policy for your organization should be.
Alistair McDonald is the author of SpamAssassin: A Pracitcal Guide to Configuration, Customization, and Integration. You can read more about Alistair's book greek deity: http://www.packtpub.com/book/spamassassin
About the Author
Alistair McDonald is a freelance IT consultant based in the UK. He has worked in IT for over 15 years and specializes in C++ and Perl development and IT infrastructure management. He is a strong advocate of open source, and has strong cross-platform skills. He prefers vim over vi, emacs over Xemacs or vim, and bash over ksh or csh. He is very much a family man and spends as much time as possible with his family enjoying life.
|
