Ed Bott's Microsoft Challenge--11/30/00

I found a combination of many things necessary to protect business database applications. 1st - we use Workgroups department managers control. Next we suggest a rather convoluted UNIQUE User password concatenating a first name + home street house number + last name. The trick is the First name may be yours - or that of the first boy/girl friend you can remember as a kid. The house number would belong to the first name person, and the last name would be from the other individual in the friend/friend relationship. (i.e., My name is Don Quigg and my first girlfriend's name (I can remember) was Alma Johnson. I lived at 705 N. Monroe St. and Alma lived at 632 N. Okland St. my password could be "don705johnson" or "Alma632Quigg". All I need recall is whether I capitolized names.

The department manager then joins Workgroup members to his/her groups depending on their responsibilities, and assigns permissions to the groups for easy maintenance. Also data is always presented via query which can eliminate sensitive data from lower level, or non departmental data readers.

We also track (and invisibly record CurrentUser() to identify the last individual modifying a record. This way each manager can be accountable for his/her data management. Provisions must be included to force bi-directional accountability in that managers must control data access and users must have permission to do what is required of them.

Then we let the Network boys take over and add whatever security they desire (or need) to protect their hardware.

Few users even know what a Workgroup is, or what (overall) software and data the company actually has. They just know when something gtes screwed up we know who, how and when the screwup cameabout. Even Internet visitors have a CurrentUser() identifyer.

My answer is fairly short and too the point. I know that my end users are going to complain if their passwords get to complicated. I don't like to make my department into a complaint department so I decided to implement a fairly easy password policy. I decided to implement that passwords be a minimum of 6 characters and that the servers will remember the last three passwords used. The users are also required to change their passwords every three months. I know that there is the possibilityto increase the number of characters used, have the servers remember more passwords, and even implement that the users are required to use numbers and characters. We have however looked into using smartcards or keystroke memorization for remote users going through the VPN and firewall. But as the users continue to complain, I can only re-assure them that I have implemented the minimum amount of security required to be "some-what" secure.

Although I administer a Novell and a AS/400 network, the issues of security are pretty much the same.
1. 3-4 times a year is pretty much the threshold that users can tolerate to change passwords. As a school District, we do it at some pretty obvious times... coming back from Christmas break, the first day of school in the fall, and then once more right after Mardi Gras. They get the holiday paycheck with a reminder printed on the stub that says
"happy *****. Remember, when you return, you must change all your passwords within 2 days, or be locked out of the Network. Call ***-*** if you need assistance."
2.we do demand unique passwords, although we don't require any exact method for picking them except that they be 7 character Alpha Numeric. We ensure that our passwords are NOT case sensitive. Too many help calls.
3. We do use intruder lockout, 3 strikes and you're out. All tech personnel are trained to swipe sticky notes, etc which appear to be Passwords when on-site, and confiscated one teacher's computer who wrote her password on the case with a magic marker.
4. We use layered passwords. You need one password to get on the network, one password to access sensitive software, and a third password to access email. Users have the same username in all 3 cases to simplify, and may elect to use the same password.
5. In the event of a lockout in any area, all 3 passwords are reset.
6. Inactivity timeout is set to 60 minutes for netware, and 45 minutes for as/400. In our case, this jives with changing classes.
7. User space on servers, and limits on file activity are monitored, and auditing is turned on, tho ( shamefully ), it is not routinely monitored, except when we suspect hacking has occurred.
9. User files on the servers are routinely scanned, looking for keywords or known hacks, such as burglar, crack, and others.

Well, I have been a system administrator for some time, on Unix/Linux, NT, Novell and now Windows 2000. The questions are always the same about security and generally I would agree that users are very tempermental about the password restrictions imposed on them.

In many cases the Management of a company does not directly share the Technical departments ideals for security, and thus are often the biggest offenders, but if management supports your policies, than this policy works well.

Users must have a complex password of at least 6 characters, there is not logical assignment of the password ( ie: old addresses and girl/boy firend names. etc.. ) The passwords are assigned by the administration team every 45 days. Our system prevents any user from altering their password and there is a password minimum age of 45 days as well as a unique history of the last 12. Meaning that if chance were to issue a duplicate password, the user would not be able to have that password for at least 1.5 years (540 days) and the system would require a different random password.

All our passwords are generated using VBScripting engine on the server that generates the new list, sets the passwords and prints out one copy which I then duplicateand distribute to the administrators who require it. There is no saved copy of the new passwords short of the hard copy in our hands, and if a hard copy becomes lost, we re-issue passwords as a security precaution as well if an administrator is letgo, or moves on to a new position.

All service accounts and Administration passwords are set to a 25 character complexity.

Our users complained a little when these policies first began, but if someone learns that it is a requirement for themto have network access and work for us, they generally decide it's not all that terrible.

Keith Benedict, MCT, MCSE, EET
System Administrator & Technical Trainer

To answer the question directly, I require at least a seven character passwords with at least one numeric character and one capitalized character and force users to change their passwords every 3 months.

But there are other options available to ensure at least moderate security. It boils down to this, most companies approach security by restricting access to specific resources when they should be allowing access to needed resources. Security has multiple layers and passwords are the last line of defence. If all other criteria are met, the password is the last attempt to verify authenticity. By only permitting access to your resources when they are needed, you are denying access in any other circumstance, by default. No administrator should ever allow full access to their systems to every IP address. It's quite obvious that remote administrative access should only be allowed from the IP addresses handed out by the ISP of the administrators and if you really want to be technical about it, there's no reason why an administrator working remotely shouldn't have a static IP address. It is silly to limit security to a password.

Anyone looking to protect their network should be looking at solutions like packet filtering, intrusion detection and logging. With these implemented, it is possible to control access by IP address and port number. It can protect against fraggmented packets, IP spoofing, redirects an DoS attacks. If that is insufficient, an intrusion detection system can actively monitor connections and alert "suspicious" activity to allowed IPs and ports. In the event your system is compromised, syslog files stored remotely can indicate what took place and help you secure that hole. Passwords are justthe tip of the iceberg.

One Word: SecureID

Luckily, my field (architecture) doesn't have ultra-sensitive information. I still require 5 digit, case-sensitive, passwords that change every 4 months, mainly because this is the simplest defense. Users still complain, but I just politely point out that this is actually part of the employee manual to adhere to network sercuity and the firm oweners approved this security scheme.

Since firewalls and so on are always a little vulernable, we aim to limit down time. We use what I call "paranoia" backups - project specific files and accounting files are backed up every two hours (SecondCopy - a great cheap app) to an old workstation through a dedicated NIC (no network load). Daily tape backups removed offsite and monthly full archive tapes to bank deposit box are included.

If a cracker was to steal our data, it's not that critical - it's only AutoCAD. But since someone could get in and crash the server & delete data just for fun, we've aimed to loose only 1 day (or less) on reconstructing our data.

Same as above. RSASecurity SecureID. I'm about to implement it in several of my client's locations. Portable, identifiable security. From what I'm seeing, this is easy to implement and hard to break.

So I just started a new job doing network support for a small software development company. Password policy.....none. In fact most if not all of the users passwords are set to a standard of users first name and first initial of their last name. As for myself, I use a standard english language word, typed backwards with some letters changed to numbers. Changing the O to Zero. and just for good measure I add a numberic value to the end. Keeping my password over 8 characters long. I haven't been here long enough to implement this kind of change globally, and my standard maybe too strict, but password policy is one that is high on the list if issues which needs to be addressed.

This question was auto closed due to inactivity