RE: Password Management

["Beauford, Jason" <jbeauford () EightInOnePet com>]

There is some truth to the 7 alphanum. password theory.  There is a fine
line between complexity-security and end user-usability.  While the
longer password may be more "secure" or more difficult to crack, it will
fail when the user, who can't remember that long alphanum. password,
writes it down on a sticky note and hides it under his/her keyboard.

Ultimately, we're talking about END USERS here and not security minded
IT people.  End Users will always be the weakest link so you MUST
accommodate them in order to have an effective Password Management
Policy.  You can have them change passwords every week and make them
include non-alphanum ascii characters, make the password be more than 7
characters, and I guarantee you that your network will be more
vulnerable as your end users will get fed up and simply write it down.
That and you'll invest some $$ in Aspirin for your Administration
Headaches as you'll be inundated with phone calls from users who didn't
write down their password and forgot it.  

Personally I prefer passphrases to passwords.    

> From your buddies at MS:  

http://www.microsoft.com/technet/community/columns/secmgmt/sm1004.mspx

http://www.microsoft.com/technet/community/columns/secmgmt/sm1104.mspx
<====This one supports my argument.

http://www.microsoft.com/technet/community/columns/secmgmt/sm1204.mspx

JMB

        |  -----Original Message-----
        |  From: Christopher Carpenter [mailto:ccarpenter () dswa net] 
        |  Sent: Friday, April 21, 2006 4:06 PM
        |  To: Jason T. Hallahan; Crawley, Jim
        |  Cc: security-basics () securityfocus com
        |  Subject: RE: Password Management
        |  
        |  That's patently false.  The longer the password, the 
        |  better it will hold up against brute force attacks.  
        |  Length and complexity also provide a measure of 
        |  protection against those using rainbow tables.
        |  
        |  Rainbow Tables (Wikipedia)
        |  http://en.wikipedia.org/wiki/Rainbow_table
        |  
        |  Password Recovery Speeds (Lockdown.co.uk) 
        |  http://www.thecrypt.co.uk/lockdown/recovery_speeds.html
        |  
        |  Chris
        |  
        |  -----Original Message-----
        |  From: Jason T. Hallahan [mailto:jthallah () gmail com]
        |  Sent: Friday, April 21, 2006 10:54 AM
        |  To: Crawley, Jim
        |  Cc: security-basics () securityfocus com
        |  Subject: Re: Password Management
        |  
        |  I read somewhere that the optimal password length 
        |  for a Windows system is actually 7 alphanumeric 
        |  characters... can anyone verify or expand on that?
        |  
        |  On 4/20/06, Crawley, Jim <Jim.Crawley () yrbrands com> wrote:
        |  >         Post-it notes on the monitor.
        |  >
        |  >

-------------------------------------------------------------------------
This List Sponsored by: Webroot

Don't leave your confidential company and customer records un-protected.
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no
obligation. See why so many companies trust Spy Sweeper Enterprise to
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise

http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------