For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Bad Policy Makes for Weak Passwords
or
Other Security Stories
|
|
|
|
December 01, 2003 (Computerworld) -- It's unprofessional to break down and sob during a meeting, but I came pretty close a few times this week as I finally began to understand the details of the IT security systems and processes my new company uses to protect itself.
I'm fairly new here, so there's a lot I still don't know. But it wasn't long before it became clear to me that things are deeply wrong. It seems like every week, I uncover layer upon layer of seemingly minor issues that undermine a lot of what we do.
This week, it was passwords. The main problem is that they're easily guessed and frequently shared. My security team continually tells users that they must pick strong passwords and not share them. But we've been unclear with users about what counts as a strong password because we've been unsure about it ourselves.
Most computer systems store a one-way encrypted password in a database. When you attempt to log in, they encrypt what you type and compare that to the stored value. If both match, the system logs you in.
If an attacker can connect to a server, he can attempt to guess the password by just trying various words; password, secret and jamesbond are favorites. But if an attacker can steal the encrypted list or password file, he can launch a more insidious attack. Instead of connecting to the server -- a slow and sometimes detectable process -- he can take a dictionary of common words and encrypt them using the same process as the server and store each in a lookup table.
If an attacker wanted to break into more than one operating system, he'd need one table for Windows servers and three for the three main kinds of Unix. Then, once he'd stolen the encrypted passwords, he could just look in the table and see which word each matched.
A hacker launching an online attack is likely to make a few hundred guesses before he's spotted or moves on. But an off-line attack can cover hundreds of thousands of passwords every second.
The problem is that operating systems' core method of storing passwords hasn't changed for many years, but the speed of computers has increased thousands of times. It has reached the point where if your encrypted Windows password file is stolen, even a low-end hacker has enough computing power to break it in a few days.
It would be nice to be able to make sure that nobody can access our password file and to teach our users not to pick the top 100 risky passwords that a hacker might use in an online attack.
Dire Situation
My predecessors spent many thousands of dollars on cracking software and hardware to test the strength of passwords, and they found that about 15% of the passwords used in my company are weak. This is actually lower than the industry average, which shows just how dire the situation is in the financial services industry.
But had a lot of work been done to find and educate the users with bad passwords? No.
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
|
 |
|
All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Why SaaS is Vital to Email and Web Security
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs.
Get this white paper now!
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- Microsoft promises four patches next week
- Google gives away home-cooked Web application security scanner
- Storm botnet stages Fourth of July attacks
- More top stories
Security Management ZoneSecurity management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.New baits 
|
"Security Directions" virtual trade show2008's Code-Red Security Issues for Protecting the EnterpriseWebcasts, white papers, demos, and more. Presented in a unique 3-d environment. Enter our show right now! Click here to enter
|
 In SecuritySecurity's important, and risk must be addressed, right? Sure, but watch for four signs your policies go a bit overboard. Click here to read the latest column by Jon Espenschied |
CIO
Computerworld
CSO
DEMO
GamePro
Games.net
IDG Connect
IDG World Expo
Infoworld
The Industry Standard
ITworld
JavaWorld
LinuxWorld
MacUser
Macworld
Network World
PC World
Playlist
Copyright © 2008 Computerworld Inc. All
rights reserved. Reproduction in whole or in part in any form or medium
without express written permission of Computerworld Inc. is prohibited.
Computerworld and Computerworld.com and the respective logos are
trademarks of International Data Group Inc.
|
