There is some truth to the 7 alphanum. password theory. There is a fine
line between complexity-security and end user-usability. While the
longer password may be more "secure" or more difficult to crack, it will
fail when the user, who can't remember that long alphanum. password,
writes it down on a sticky note and hides it under his/her keyboard.
Ultimately, we're talking about END USERS here and not security minded
IT people. End Users will always be the weakest link so you MUST
accommodate them in order to have an effective Password Management
Policy. You can have them change passwords every week and make them
include non-alphanum ascii characters, make the password be more than 7
characters, and I guarantee you that your network will be more
vulnerable as your end users will get fed up and simply write it down.
That and you'll invest some $$ in Aspirin for your Administration
Headaches as you'll be inundated with phone calls from users who didn't
write down their password and forgot it.
Personally I prefer passphrases to passwords.
From your buddies at MS:
http://www.microsoft.com/technet/community/columns/secmgmt/sm1004.mspx
http://www.microsoft.com/technet/community/columns/secmgmt/sm1104.mspx
<====This one supports my argument.
http://www.microsoft.com/technet/community/columns/secmgmt/sm1204.mspx
JMB
| -----Original Message-----
| From: Christopher Carpenter [mailto:ccarpenter@dswa.net]
| Sent: Friday, April 21, 2006 4:06 PM
| To: Jason T. Hallahan; Crawley, Jim
| Cc: security-basics@securityfocus.com
| Subject: RE: Password Management
|
| That's patently false. The longer the password, the
| better it will hold up against brute force attacks.
| Length and complexity also provide a measure of
| protection against those using rainbow tables.
|
| Rainbow Tables (Wikipedia)
| http://en.wikipedia.org/wiki/Rainbow_table
|
| Password Recovery Speeds (Lockdown.co.uk)
| http://www.thecrypt.co.uk/lockdown/recovery_speeds.html
|
| Chris
|
| -----Original Message-----
| From: Jason T. Hallahan [mailto:jthallah@gmail.com]
| Sent: Friday, April 21, 2006 10:54 AM
| To: Crawley, Jim
| Cc: security-basics@securityfocus.com
| Subject: Re: Password Management
|
| I read somewhere that the optimal password length
| for a Windows system is actually 7 alphanumeric
| characters... can anyone verify or expand on that?
|
| On 4/20/06, Crawley, Jim <Jim.Crawley@yrbrands.com> wrote:
| > Post-it notes on the monitor.
| >
| >
-------------------------------------------------------------------------
This List Sponsored by: Webroot
Don't leave your confidential company and customer records un-protected.
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no
obligation. See why so many companies trust Spy Sweeper Enterprise to
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise
http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------
