The Password Is: Useless (Probably)

Computerworld - What good is a firewall when you can crack more than 50% of the passwords on the network?
It was just a fluke that we ran a password audit last week on our own domain and that of a subsidiary with which we have a full two-way trust relationship. I was disheartened after looking at the results of the report. I called the security team together and said, "We might as well go home. There's absolutely no point in banging our heads against the wall any longer."
Why was this password audit a fluke rather than a regular security measure? The fact is that we have so many things on our task lists that sometimes the most obvious part of security is overlooked. We suffer from a lack of staff, lack of tools, lack of time, lack of security awareness and lack of security policy enforcement. And being new to the company, I made a fundamental error in assuming that the stated password policy, which had been signed off on by executives and posted on the company intranet, was actually being enforced by IT across our domain and those of our subsidiaries. In a way, my awareness of the importance of secure passwords made me blind to the problem: Since I care about my password being cracked, I chose a secure one, and so I didn't stop to test the password policy.
We're back to square one. Without a properly enforced password policy, who cares if the firewall is logging properly, the SQL Server password is blank or our patches are up to date? Passwords are the first line of defense.
In a Windows network, the password policy is set at the domain level, and in our environment, that's managed by Active Directory. Our current password policy includes these provisions:

• Ten passwords are remembered, which means you can't reuse a password until you've chosen your 11th.


• Passwords expire after a maximum of 45 days.


• The password must meet "complexity requirements": They can't contain all or part of the user's account name, they must be at least eight characters long, and the characters must be chosen from three of four categories -- English uppercase characters, English lowercase characters, base-10 digits and nonalphabetic characters such as !, $ or #.