There is a section covering Countering Password Guessing 12.2.2 in Matt
Bishop's "Computer Security Art and Science". It explains the complex
formulas which are used to derive a safe password length. Depending on
factors such as possible passwords, units of time between guesses, and
number of guesses per lockout if it in facts has lock out, it derives what a
safe length should be. The thought of actually calculating this in one's
own environment based on the factors present there seems like overkill. I
believe that is why we all just look at Best Practices.
Zacharia Thompson, cissp, gsec, nsa-iam, mcse, mcp+i, net+, a+
Sr. Security Administrator
North American Coal
-----Original Message-----
From: Sulaiman, Wilmar [mailto:wsulaiman@siddharta.co.id]
Sent: Thursday, January 19, 2006 4:11 AM
To: security-management@securityfocus.com
Subject: Password Management policy?
Importance: Low
Dear all,
I noticed that "best practice" for Minimum password length policy is
either 6 or 8 characters. I guess SANS institute considered a weak
password if it is less than 8 characters.
I would like to know where they derived the number (6 and 8 characters).
Is there any documentation to backup it up why the best practice for
minimum password length is set to 6?
Wilmar Sulaiman
Risk Advisory Services
KPMG Siddharta Siddharta & Widjaja
32nd Floor, GKBI Building
28, Jl. Jend. Sudirman
Jakarta 10210, Indonesia
J : +62 (0) 21 574 2333
Fax : +62 (0) 21 574 1777
**********************************************************************
The information in this e-mail is confidential and may be legally
privileged. It is intended solely for the addressee. Access to this e-mail
by anyone else is unauthorized. If you have received this communication in
error, please address with the subject heading "Received in error," send to
postmaster@siddharta.co.id, then delete the e-mail and destroy any copies of
it. If you are not the intended recipient, any disclosure, copying,
distribution or any action taken in reliance on it, is prohibited and may be
unlawful. Any opinions or advice contained in this e-mail are subject to the
terms and conditions expressed in the governing Siddharta Siddharta &
Widjaja/PT Siddharta Consulting client engagement letter. Opinions,
conclusions and other information in this e-mail and any attachments that do
not relate to the official business of the firm are neither given nor
endorsed by it.
Siddharta Siddharta & Widjaja/PT Siddharta Consulting cannot guarantee that
e-mail communications are secure or error-free, as information could be
intercepted, corrupted, amended, lost, destroyed, arrive late or incomplete,
or contain viruses.
Siddharta Siddharta & Widjaja - Registered Public Accountants, registered in
Indonesia, is a member firm of KPMG International. PT Siddharta Consulting,
a limited liability company registered in Indonesia, is a member firm of
KPMG International. KPMG International is a Swiss cooperative of which all
KPMG firms are members. KPMG International provides no professional services
to clients. Each member firm is a separate and independent legal entity and
each describes itself as such.
This footnote also confirms that this e-mail message has been swept by
MIMEsweeper for the presence of computer viruses. See www.mimesweeper.com
for more information.
**********************************************************************
NOTICE: This message may contain privileged and confidential information which
is protected from disclosure. If you are not the addressee indicated in this
communication (or an agent or employee responsible for delivering this
communication to such person), you may not read, copy, use or disseminate this
message to any other person. In such case, you should destroy this
communication and kindly notify the sender immediately by reply email or
telephone. Please advise the sender immediately if you or your employer do not
consent to Internet email for messages of this kind. This communication is
restricted to the intended recipient and is not to be provided to a third party
without the prior consent of The North American Coal Corporation or its
representatives.
