Selecting Secure Passwords & Building an Enterprise Password Policy
Although many modern alternatives for user authentication exist today—such as biometrics, smart cards, and one-time passwords—most organizations still rely heavily on traditional passwords. Users frequently reuse simple passwords based on personal information, making them an easy target for attackers.
Understanding how passwords are attacked, stored, and managed in Windows operating systems is essential for establishing an effective security policy.
1. Common Password Attack Vectors
Attackers rely on several standard methods to guess or compromise user accounts:
- Guessing: Manually trying obvious choices like birthdays, city names, pets, or sports teams.
- Online Dictionary Attacks: Using automated scripts to attempt logins against live services with lists of common words.
- Offline Dictionary Attacks: Obtaining password hashes and comparing them against candidate passwords locally.
- Offline Brute-Force Attacks: Testing possible character combinations against stolen password hashes.
2. Password Storage in Windows: LM vs. NTLM Hashes
Windows does not ordinarily store account passwords as plain text. Instead, Windows authentication uses password-derived values called hashes. Local account information is maintained in the Security Accounts Manager (SAM), while domain account information is managed through Active Directory.
- LAN Manager (LM) Hash: An obsolete, weak password hash that converts characters to uppercase, pads passwords to 14 characters, splits them into two 7-character chunks, and processes each chunk separately. This design makes LM hashes particularly vulnerable to cracking.
- NTLM Hash: A password hash based on MD4 that supports Unicode passwords and preserves case distinctions. Although stronger than LM in several respects, NTLM is also an older construction and is vulnerable to offline password cracking. It should not be considered a modern password-storage recommendation.
3. Technical Settings for Organizational Password Policies
Administrators can configure password-related settings through Windows security policies and domain Group Policy. The appropriate settings depend on the organization’s environment and current security guidance.
| Setting | Description | Example / Guidance |
|---|---|---|
| Enforce password history | Prevents recently used passwords from being reused. | For example, remember 24 previous passwords. |
| Maximum password age | Sets how long a password may be used before it must be changed. | Follow your organization’s risk requirements and current guidance; routine expiration is not always recommended for passwords without evidence of compromise. |
| Minimum password age | Helps prevent users from cycling through passwords rapidly to bypass password history. | Choose a value appropriate to your password-history policy. |
| Minimum password length | Sets the minimum number of characters in a password. | Prefer long passwords or passphrases; avoid treating eight characters as a universal modern target. |
| Password complexity | Applies Windows password-complexity requirements. | Evaluate alongside length, password blocklists, and protection against compromised passwords. |
4. Passphrases vs. Complex Passwords
Instead of forcing users to remember short, cryptic passwords, administrators can encourage the use of passphrases. Longer passwords made from several words can be easier to remember while providing strong resistance to guessing when the words are chosen appropriately.
Organizations should also allow sufficiently long passwords, screen new passwords against common or compromised choices where possible, and encourage the use of password managers. Character substitutions alone do not necessarily make a predictable password secure.
River!Candle7-Mountain-CloudThis is an illustrative example, not a password to use for a real account. Create unique passwords for your accounts and avoid using publicly displayed examples.
5. Do’s and Don’ts for Password Creation
Do:
- Use long, unique passwords or passphrases that are difficult to guess.
- Use a reputable password manager to generate and store unique passwords.
- Enable multifactor authentication, especially for administrator and other sensitive accounts.
- Change a password promptly if it is compromised or there is reason to believe it has been exposed.
Don’t:
- Use personal information such as family names, pets, phone numbers, or birthdays.
- Rely on predictable dictionary words or simple substitutions as the only security measure.
- Build passwords around the current month, season, or other predictable patterns.
- Reuse passwords across multiple services or share them with other people.
Conclusion
A well-designed password policy combines appropriate technical controls with clear, realistic guidance for end users. Strong unique passwords, password managers, multifactor authentication, and protection against compromised credentials can significantly improve organizational security.
Rather than relying on complexity rules alone, organizations should focus on password length, uniqueness, secure authentication, and practical measures that reduce the risk of account compromise.
Geef een reactie