[Fwd: Re: Secure Password Policy?]

["Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa () pacbell net>]

-------- Original Message --------
Subject:        Re: Secure Password Policy?
Date:   Thu, 19 Jan 2006 10:41:31 -0800
From: 	Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] 
<sbradcpa () pacbell net>
To: 	Sulaiman, Wilmar <wsulaiman () siddharta co id>, 
wsulaiman () siddharta co id
References: 
<5F63869CFE03124796730178626BF04D02476B95 () IDJKTEXC92 id kworld kpmg com>



Your password policy should not be 6.. .but as long as deemed 
appropriate for the risk of the device you are protecting.

The Great Debates: Pass Phrases vs. Passwords. Part 2 of 3:
http://www.microsoft.com/technet/security/secnews/articles/itproviewpoint100504.mspx
The Great Debates: Pass Phrases vs. Passwords. Part 1 of 3:
http://www.microsoft.com/technet/security/secnews/articles/itproviewpoint091004.mspx
The Great Debates: Pass Phrases vs. Passwords. Part 3 of 3 -- TechNet 
Column - Security Management - December 2004:
http://www.microsoft.com/technet/community/columns/secmgmt/sm1204.mspx

If lmhashes are enabled in a firm, a 6 character password is trivial to 
break/sniff with LC5 [well until Symantec sunsets it anyway....]

Protecting your Windows Network [Johansson/Riley] has an excellent 
chapter on passwords.
http://www.protectyourwindowsnetwork.com/default.htm


Sulaiman, Wilmar wrote:

> Dear all,
>
> I noticed that "best practice" for Minimum password length policy is
> either 6 or 8 characters. I guess SANS institute considered a weak
> password if it is less than 8 characters.  
>
> I would like to know where they derived the number (6 and 8 characters).
> Is there any documentation to backup it up why the best practice for
> minimum password length is set to 6?
>
> Wilmar Sulaiman
> Risk Advisory Services
> KPMG Siddharta Siddharta & Widjaja
> 32nd Floor, GKBI Building
> 28, Jl. Jend. Sudirman
> Jakarta 10210, Indonesia
> J : +62 (0) 21 574 2333
> Fax : +62 (0) 21 574 1777
>
> **********************************************************************
> The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this 
> e-mail by anyone else is unauthorized. If you have received this communication in error, please address with the subject heading 
> "Received in error," send to postmaster () siddharta co id, then delete the e-mail and destroy any copies of it. If you are 
> not the intended recipient, any disclosure, copying, distribution or any action taken in reliance on it, is prohibited and may be 
> unlawful. Any opinions or advice contained in this e-mail are subject to the terms and conditions expressed in the governing 
> Siddharta Siddharta & Widjaja/PT Siddharta Consulting client engagement letter. Opinions, conclusions and other information in 
> this e-mail and any attachments that do not relate to the official business of the firm are neither given nor endorsed by it.
>
> Siddharta Siddharta & Widjaja/PT Siddharta Consulting cannot guarantee that e-mail communications are secure or 
> error-free, as information could be intercepted, corrupted, amended, lost, destroyed, arrive late or incomplete, or contain 
> viruses.
>
> Siddharta Siddharta & Widjaja - Registered Public Accountants, registered in Indonesia, is a member firm of KPMG 
> International. PT Siddharta Consulting, a limited liability company registered in Indonesia, is a member firm of KPMG 
> International. KPMG International is a Swiss cooperative of which all KPMG firms are members. KPMG International provides 
> no professional services to clients. Each member firm is a separate and independent legal entity and each describes itself 
> as such.
>
> This footnote also confirms that this e-mail message has been swept by MIMEsweeper for the presence of computer 
> viruses. See www.mimesweeper.com for more information.
> **********************************************************************
>
>
> ------------------------------------------------------------------------------
> Audit your website security with Acunetix Web Vulnerability Scanner: 
>
> Hackers are concentrating their efforts on attacking applications on your 
> website. Up to 75% of cyber attacks are launched on shopping carts, forms, 
> login pages, dynamic content etc. Firewalls, SSL and locked-down servers are 
> futile against web application hacking. Check your website for vulnerabilities 
> to SQL injection, Cross site scripting and other web attacks before hackers do! 
> Download Trial at:
>
> http://www.securityfocus.com/sponsor/pen-test_050831
> -------------------------------------------------------------------------------
>
>
>  

--
Letting your vendors set your risk analysis these days?  
http://www.threatcode.com




--
Letting your vendors set your risk analysis these days?  
http://www.threatcode.com


------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner: 

Hackers are concentrating their efforts on attacking applications on your 
website. Up to 75% of cyber attacks are launched on shopping carts, forms, 
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are 
futile against web application hacking. Check your website for vulnerabilities 
to SQL injection, Cross site scripting and other web attacks before hackers do! 
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------