Sorry if this subject has been flogged to death, but a recent example
from one of my own users:
User A is off work and calls in and asks colleague, user B to access her
email and supplies domain password (it doesn't matter how many times you
tell them not to tell anyone their password, they still do). User A has
internet access for business user B does not (it is hard enough to get
her to work at the best of times). User B surfs internet until user A is
forced to change password after 1 week (passwords rotate every 30 days).
As internet usage is only checked monthly (there are few problems) no
alarm bells sound until user B tries to use User A login and is booted
out for wrong user password combi and it shows up in logs.
Result: User A has sheepish conversation with IT Dept on importance of
not revealing passwords and ticking off from management.
Regards
Mike Molloy
IT Supervisor
-----Original Message-----
From: Ansgar -59cobalt- Wiechers [mailto:bugtraq@planetcobalt.net]
Sent: 25 July 2004 00:38
To: security-basics@securityfocus.com
Subject: Re: Minimum password requirements
On 2004-07-22 dmargoli@stwing.org wrote:
Steve wrote:
We can discuss/argue all day long, but if you don't age passwords
then you will fail almost any IT portion of an audit from an
independent auditing organization.
Fair enough, but that doesn't really explain *why* it makes sense (or
even if it does).
In my reply to Robert's mail I had mentioned one reason: to limit the
time a cracked/leaked password can be used by an attacker.
Regards
Ansgar Wiechers
--
"Those who would give up liberty for a little temporary safety
deserve neither liberty nor safety, and will lose both."
--Benjamin Franklin
------------------------------------------------------------------------
---
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545
off
any course! All of our class sizes are guaranteed to be 10 students or
less
to facilitate one-on-one interaction with one of our expert instructors.
Attend a course taught by an expert instructor with years of
in-the-field
pen testing experience in our state of the art hacking lab. Master the
skills
of an Ethical Hacker to better assess the security of your organization.
Visit us at:
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
------------------------------------------------------------------------
----
#####################################################################################
Note:
This message is for the named person's use only. It may contain confidential,
proprietary or legally privileged information. No confidentiality or privilege
is waived or lost by any mistransmission. If you receive this message in error,
please immediately delete it and all copies of it from your system, destroy any
hard copies of it and notify the sender. You must not, directly or indirectly,
use, disclose, distribute, print, or copy any part of this message if you are
not
the intended recipient. Coen Holdings Ltd. and any of its subsidiaries each
reserve
the right to monitor all e-mail communications through its networks.
Any views expressed in this message are those of the individual sender, except
where
the message states otherwise and the sender is authorized to state them to be
the
views of any such entity.
Thank You.
#####################################################################################
---------------------------------------------------------------------------
Computer Forensics Training at the InfoSec Institute. All of our class sizes
are guaranteed to be 12 students or less to facilitate one-on-one
interaction with one of our expert instructors. Gain the in-demand skills of
a certified computer examiner, learn to recover trace data left behind by
fraud, theft, and cybercrime perpetrators. Discover the source of computer
crime and abuse so that it never happens again.
http://www.securityfocus.com/sponsor/InfoSecInstitute_security-basics_040817
----------------------------------------------------------------------------
