I just came across this Dark Reading bit by Adrian Lane on wiping out wimpy passwords. Adrian says that user training is needed so people know how to create strong passwords. I’m not picking on you Adrian however this has become a downright ridiculous approach, one that’s been proven time and again not to work.
My take is if you have to set your users up for success and, therefore, have to MAKE them create strong passphrases. It’s as simple as enabling minimum password complexity policies in the OS and building in strong passphrase requirements within Web applications so that they don’t have the option to take the path of least resistance.
Just like anti-lock brake systems in automobiles, circuit breakers in home electrical panels, and seat belt requirements on airplanes, we have to build in security controls that set our users up for success. Period. Unless and until we do, we’re going to continue having the same old ridiculous password issues we’ve always had.
“A business associate referred our company to Principle Logic when we were seeking a resource to perform vulnerability /penetration testing for our external and internal networks. We found Kevin Beaver to be professional, well informed, and easy to work with. His testing did not disrupt our networks, and his progress updates were timely.
His final report was very thorough and included security recommendations for our network environment. The executive leadership was so impressed with Kevin’s security expertise, they have extended their agreement to continue to perform periodic testing. We highly recommend Kevin Beaver and Principle Logic as a resource for network security testing.”