0

We're trying to come up with a policy for required password-strength for Windows passwords on our domain. I was leaning towards a 10 character minimum with special characters and uppercase. We have a policy so accounts lock after a number of incorrect guesses, so combined with a minimum length and complexity requirement, is this sufficient in today's environment? What other password measures can/should be taken?

(I know similar questions have been asked before but the state of password security has changed substantially in the past year or two.)

closed as too broad by joeqwerty, Zoredache, DanBig, Skyhawk, Michael Hampton Oct 18 '13 at 19:39

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    "We have a policy so accounts lock after a number of incorrect guesses" - A hilarious setting - now anyone can lock anyone out, over and over again, from anywhere! – TessellatingHeckler Oct 18 '13 at 17:31
  • Except that it's not accessible from the web... – MgSam Oct 18 '13 at 19:19
  • You might also consider visiting our sister site Information Security. – Michael Hampton Oct 18 '13 at 19:39
  • @MgSam: I didn't mean "anywhere on the web", I meant a disgruntled receptionist can lock out the CEO, from their coworker's computer two offices away. – TessellatingHeckler Oct 23 '13 at 15:01
3

http://xkcd.com/936/

It may be a cartoon, but it makes a very good point. Special characters and a mix of case can be hard for some people to remember. Longer passwords can be very easy to remember, and more secure. Just a thought, something to bear in mind.

  • If you read the article I linked, you would have seen that this advice isn't necessarily true anymore. – MgSam Oct 18 '13 at 19:21
  • You may be right. Am I being blind though, I can't see any links that you've posted? – Codemonkey Oct 18 '13 at 21:40
1

Password security and password management are hazards to watch out for.

Some common security tactics include, but are not limited to:

  • minimum character length (some argue 6, some argue 8)
  • case sensitivity
  • numeric values
  • special characters ()'"/?`~!@#$%^&*-=+ and the space character
  • password expiration
  • password history differentiation (meaning the password cannot be similar to the x number of historical passwords)

Some argue that doing the above is enough, but others will argue that it's still not enough.

Others argue that complexity of passwords should be sufficient to secure the password, but the problems with more complex passwords is they are harder to remember for the user, which means they'll write it down or use a variation of the previous password; both of which are risks to take into account.

Not to mention how some believe letter substitution is sufficient; like, instead of hackers for a password, you use 4@ck3r5. This doesn't help as much as people believe if someone is using a common password database with subsitution algorithm.

One interesting route is to have users use passphrases, instead of passwords. The difference? Passphrases are easier to remember and inherently take into account all of you password complexity requirements. Example: I'm the 1st king of England! is as complex, if not more complex than adf983l3.2-aa!#s0 and the former is easier to remember.

Note: employing a password policy isn't the be-all-end-all of protecting your systems from intruders. It's just one in a litany of other counter-measures you need to put in place, and you should always weigh your security policy against the aptitude of your systems and users. You can be balls-to-the-walls secured with the latest, greatest and most secure system in the world, but if your user still writes their passwords on sticky notes and tapes it to the side of their monitor, you've got bigger problems.

  • Exactly who is arguing that 6-character passwords are sufficient? I would like to make a bet with him. – Skyhawk Oct 18 '13 at 18:04
  • 2
    @Skyhawk - it's all a matter of risk management and your possibility of exposure. Some companies are fine with the risk, heck they may not even require passwords at all in a small shop. Others require two-factor auth, etc. It's not a one size fits all concept. – TheCleaner Oct 18 '13 at 18:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.