Suche senden
Hochladen
Password War Games Webinar
•
1 gefällt mir
•
1,511 views
nCircle - a Tripwire Company
Folgen
nCircle Webinar Speaker John Alexander
Weniger lesen
Mehr lesen
Business
Melden
Teilen
Melden
Teilen
1 von 51
Jetzt herunterladen
Downloaden Sie, um offline zu lesen
Empfohlen
Password Policies
Password Policies
allengalvan
Password Storage Sucks!
Password Storage Sucks!
nerdybeardo
Juice Jacking 101
Juice Jacking 101
Robert Rowley
Password Patterns- An Analysis
Password Patterns- An Analysis
Dr. Emin İslam Tatlı
Password Security
Password Security
Alex Hyer
Угадываем пароль за минуту
Угадываем пароль за минуту
Positive Hack Days
Password cracking and brute force
Password cracking and brute force
vishalgohel12195
How to Design Passwords
How to Design Passwords
University of Hertfordshire
Empfohlen
Password Policies
Password Policies
allengalvan
Password Storage Sucks!
Password Storage Sucks!
nerdybeardo
Juice Jacking 101
Juice Jacking 101
Robert Rowley
Password Patterns- An Analysis
Password Patterns- An Analysis
Dr. Emin İslam Tatlı
Password Security
Password Security
Alex Hyer
Угадываем пароль за минуту
Угадываем пароль за минуту
Positive Hack Days
Password cracking and brute force
Password cracking and brute force
vishalgohel12195
How to Design Passwords
How to Design Passwords
University of Hertfordshire
2012 03 The Death of Passwords
2012 03 The Death of Passwords
Raleigh ISSA
Password policies
Password policies
Ari Elias-Bachrach
PASSWORD BEST PRACTICES
PASSWORD BEST PRACTICES
Razorpoint Security
RSA Algorithm
RSA Algorithm
Joon Young Park
Why is password protection a fallacy a point of view
Why is password protection a fallacy a point of view
Yury Chemerkin
Password Management
Password Management
Rick Chin
Password (in)security
Password (in)security
Enrico Zimuel
Cryptography (under)engineering
Cryptography (under)engineering
slicklash
Computer Privacy:Passwords-Mike B.
Computer Privacy:Passwords-Mike B.
Mike Barker
ZeroNights2013 testing of password policy
ZeroNights2013 testing of password policy
Anton Dedov
Anton Dedov - Testing of password policy
Anton Dedov - Testing of password policy
DefconRussia
Let me in! 10 tips to better passwords
Let me in! 10 tips to better passwords
Marian Merritt
How to Use Cryptography Properly: Common Mistakes People Make When Using Cry...
How to Use Cryptography Properly: Common Mistakes People Make When Using Cry...
All Things Open
CCNA Security 012- cryptographic systems
CCNA Security 012- cryptographic systems
Ahmed Habib
Introduction to cryptography part2-final
Introduction to cryptography part2-final
Taymoor Nazmy
Security.ppt
Security.ppt
SherefHesham
Security Meetup 22 октября. «When big brick wall becomes wooden fence» or «ho...
Security Meetup 22 октября. «When big brick wall becomes wooden fence» or «ho...
Mail.ru Group
Lets talk about bug hunting
Lets talk about bug hunting
Kirill Ermakov
Lesson Presentation Powerful Passwords.pptx
Lesson Presentation Powerful Passwords.pptx
AllanGuevarra1
Cryptography - Overview
Cryptography - Overview
Mohammed Adam
Computer Forensics Bootcamp
Computer Forensics Bootcamp
nCircle - a Tripwire Company
Google-Jacking: A Review of Google 2-Factor Authentication
Google-Jacking: A Review of Google 2-Factor Authentication
nCircle - a Tripwire Company
Weitere ähnliche Inhalte
Ähnlich wie Password War Games Webinar
2012 03 The Death of Passwords
2012 03 The Death of Passwords
Raleigh ISSA
Password policies
Password policies
Ari Elias-Bachrach
PASSWORD BEST PRACTICES
PASSWORD BEST PRACTICES
Razorpoint Security
RSA Algorithm
RSA Algorithm
Joon Young Park
Why is password protection a fallacy a point of view
Why is password protection a fallacy a point of view
Yury Chemerkin
Password Management
Password Management
Rick Chin
Password (in)security
Password (in)security
Enrico Zimuel
Cryptography (under)engineering
Cryptography (under)engineering
slicklash
Computer Privacy:Passwords-Mike B.
Computer Privacy:Passwords-Mike B.
Mike Barker
ZeroNights2013 testing of password policy
ZeroNights2013 testing of password policy
Anton Dedov
Anton Dedov - Testing of password policy
Anton Dedov - Testing of password policy
DefconRussia
Let me in! 10 tips to better passwords
Let me in! 10 tips to better passwords
Marian Merritt
How to Use Cryptography Properly: Common Mistakes People Make When Using Cry...
How to Use Cryptography Properly: Common Mistakes People Make When Using Cry...
All Things Open
CCNA Security 012- cryptographic systems
CCNA Security 012- cryptographic systems
Ahmed Habib
Introduction to cryptography part2-final
Introduction to cryptography part2-final
Taymoor Nazmy
Security.ppt
Security.ppt
SherefHesham
Security Meetup 22 октября. «When big brick wall becomes wooden fence» or «ho...
Security Meetup 22 октября. «When big brick wall becomes wooden fence» or «ho...
Mail.ru Group
Lets talk about bug hunting
Lets talk about bug hunting
Kirill Ermakov
Lesson Presentation Powerful Passwords.pptx
Lesson Presentation Powerful Passwords.pptx
AllanGuevarra1
Cryptography - Overview
Cryptography - Overview
Mohammed Adam
Ähnlich wie Password War Games Webinar
(20)
2012 03 The Death of Passwords
2012 03 The Death of Passwords
Password policies
Password policies
PASSWORD BEST PRACTICES
PASSWORD BEST PRACTICES
RSA Algorithm
RSA Algorithm
Why is password protection a fallacy a point of view
Why is password protection a fallacy a point of view
Password Management
Password Management
Password (in)security
Password (in)security
Cryptography (under)engineering
Cryptography (under)engineering
Computer Privacy:Passwords-Mike B.
Computer Privacy:Passwords-Mike B.
ZeroNights2013 testing of password policy
ZeroNights2013 testing of password policy
Anton Dedov - Testing of password policy
Anton Dedov - Testing of password policy
Let me in! 10 tips to better passwords
Let me in! 10 tips to better passwords
How to Use Cryptography Properly: Common Mistakes People Make When Using Cry...
How to Use Cryptography Properly: Common Mistakes People Make When Using Cry...
CCNA Security 012- cryptographic systems
CCNA Security 012- cryptographic systems
Introduction to cryptography part2-final
Introduction to cryptography part2-final
Security.ppt
Security.ppt
Security Meetup 22 октября. «When big brick wall becomes wooden fence» or «ho...
Security Meetup 22 октября. «When big brick wall becomes wooden fence» or «ho...
Lets talk about bug hunting
Lets talk about bug hunting
Lesson Presentation Powerful Passwords.pptx
Lesson Presentation Powerful Passwords.pptx
Cryptography - Overview
Cryptography - Overview
Mehr von nCircle - a Tripwire Company
Computer Forensics Bootcamp
Computer Forensics Bootcamp
nCircle - a Tripwire Company
Google-Jacking: A Review of Google 2-Factor Authentication
Google-Jacking: A Review of Google 2-Factor Authentication
nCircle - a Tripwire Company
Continuous Monitoring 2.0
Continuous Monitoring 2.0
nCircle - a Tripwire Company
2012 nCircle Federal Security and Compliance Trends Survey
2012 nCircle Federal Security and Compliance Trends Survey
nCircle - a Tripwire Company
Applying Boyd's OODA Loop Strategy to Drive IT Security Decision and Action
Applying Boyd's OODA Loop Strategy to Drive IT Security Decision and Action
nCircle - a Tripwire Company
Compliance what does security have to do with it
Compliance what does security have to do with it
nCircle - a Tripwire Company
Security on a budget
Security on a budget
nCircle - a Tripwire Company
nCircle Webinar: Get your Black Belt
nCircle Webinar: Get your Black Belt
nCircle - a Tripwire Company
Real world security webinar (v2012-05-30)
Real world security webinar (v2012-05-30)
nCircle - a Tripwire Company
Mehr von nCircle - a Tripwire Company
(9)
Computer Forensics Bootcamp
Computer Forensics Bootcamp
Google-Jacking: A Review of Google 2-Factor Authentication
Google-Jacking: A Review of Google 2-Factor Authentication
Continuous Monitoring 2.0
Continuous Monitoring 2.0
2012 nCircle Federal Security and Compliance Trends Survey
2012 nCircle Federal Security and Compliance Trends Survey
Applying Boyd's OODA Loop Strategy to Drive IT Security Decision and Action
Applying Boyd's OODA Loop Strategy to Drive IT Security Decision and Action
Compliance what does security have to do with it
Compliance what does security have to do with it
Security on a budget
Security on a budget
nCircle Webinar: Get your Black Belt
nCircle Webinar: Get your Black Belt
Real world security webinar (v2012-05-30)
Real world security webinar (v2012-05-30)
Kürzlich hochgeladen
SEO Case Study: How I Increased SEO Traffic & Ranking by 50-60% in 6 Months
SEO Case Study: How I Increased SEO Traffic & Ranking by 50-60% in 6 Months
IndeedSEO
Quick Doctor In Kuwait +2773`7758`557 Kuwait Doha Qatar Dubai Abu Dhabi Sharj...
Quick Doctor In Kuwait +2773`7758`557 Kuwait Doha Qatar Dubai Abu Dhabi Sharj...
daisycvs
Lundin Gold - Q1 2024 Conference Call Presentation (Revised)
Lundin Gold - Q1 2024 Conference Call Presentation (Revised)
Adnet Communications
Falcon's Invoice Discounting: Your Path to Prosperity
Falcon's Invoice Discounting: Your Path to Prosperity
hemanthkumar470700
Unveiling Falcon Invoice Discounting: Leading the Way as India's Premier Bill...
Unveiling Falcon Invoice Discounting: Leading the Way as India's Premier Bill...
Falcon Invoice Discounting
Falcon Invoice Discounting: Unlock Your Business Potential
Falcon Invoice Discounting: Unlock Your Business Potential
Falcon investment
Call Girls Service In Old Town Dubai ((0551707352)) Old Town Dubai Call Girl ...
Call Girls Service In Old Town Dubai ((0551707352)) Old Town Dubai Call Girl ...
allensay1
Value Proposition canvas- Customer needs and pains
Value Proposition canvas- Customer needs and pains
P&CO
Call Girls Kengeri Satellite Town Just Call 👗 7737669865 👗 Top Class Call Gir...
Call Girls Kengeri Satellite Town Just Call 👗 7737669865 👗 Top Class Call Gir...
amitlee9823
(Anamika) VIP Call Girls Napur Call Now 8617697112 Napur Escorts 24x7
(Anamika) VIP Call Girls Napur Call Now 8617697112 Napur Escorts 24x7
Call Girls in Nagpur High Profile Call Girls
Call Girls in Delhi, Escort Service Available 24x7 in Delhi 959961-/-3876
Call Girls in Delhi, Escort Service Available 24x7 in Delhi 959961-/-3876
dlhescort
Marel Q1 2024 Investor Presentation from May 8, 2024
Marel Q1 2024 Investor Presentation from May 8, 2024
Marel
👉Chandigarh Call Girls 👉9878799926👉Just Call👉Chandigarh Call Girl In Chandiga...
👉Chandigarh Call Girls 👉9878799926👉Just Call👉Chandigarh Call Girl In Chandiga...
rajveerescorts2022
Dr. Admir Softic_ presentation_Green Club_ENG.pdf
Dr. Admir Softic_ presentation_Green Club_ENG.pdf
Admir Softic
Call Girls Hebbal Just Call 👗 7737669865 👗 Top Class Call Girl Service Bangalore
Call Girls Hebbal Just Call 👗 7737669865 👗 Top Class Call Girl Service Bangalore
amitlee9823
Nelamangala Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore...
Nelamangala Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore...
amitlee9823
Malegaon Call Girls Service ☎ ️82500–77686 ☎️ Enjoy 24/7 Escort Service
Malegaon Call Girls Service ☎ ️82500–77686 ☎️ Enjoy 24/7 Escort Service
Damini Dixit
Russian Call Girls In Gurgaon ❤️8448577510 ⊹Best Escorts Service In 24/7 Delh...
Russian Call Girls In Gurgaon ❤️8448577510 ⊹Best Escorts Service In 24/7 Delh...
lizamodels9
Call Girls From Pari Chowk Greater Noida ❤️8448577510 ⊹Best Escorts Service I...
Call Girls From Pari Chowk Greater Noida ❤️8448577510 ⊹Best Escorts Service I...
lizamodels9
unwanted pregnancy Kit [+918133066128] Abortion Pills IN Dubai UAE Abudhabi
unwanted pregnancy Kit [+918133066128] Abortion Pills IN Dubai UAE Abudhabi
Abortion pills in Kuwait Cytotec pills in Kuwait
Kürzlich hochgeladen
(20)
SEO Case Study: How I Increased SEO Traffic & Ranking by 50-60% in 6 Months
SEO Case Study: How I Increased SEO Traffic & Ranking by 50-60% in 6 Months
Quick Doctor In Kuwait +2773`7758`557 Kuwait Doha Qatar Dubai Abu Dhabi Sharj...
Quick Doctor In Kuwait +2773`7758`557 Kuwait Doha Qatar Dubai Abu Dhabi Sharj...
Lundin Gold - Q1 2024 Conference Call Presentation (Revised)
Lundin Gold - Q1 2024 Conference Call Presentation (Revised)
Falcon's Invoice Discounting: Your Path to Prosperity
Falcon's Invoice Discounting: Your Path to Prosperity
Unveiling Falcon Invoice Discounting: Leading the Way as India's Premier Bill...
Unveiling Falcon Invoice Discounting: Leading the Way as India's Premier Bill...
Falcon Invoice Discounting: Unlock Your Business Potential
Falcon Invoice Discounting: Unlock Your Business Potential
Call Girls Service In Old Town Dubai ((0551707352)) Old Town Dubai Call Girl ...
Call Girls Service In Old Town Dubai ((0551707352)) Old Town Dubai Call Girl ...
Value Proposition canvas- Customer needs and pains
Value Proposition canvas- Customer needs and pains
Call Girls Kengeri Satellite Town Just Call 👗 7737669865 👗 Top Class Call Gir...
Call Girls Kengeri Satellite Town Just Call 👗 7737669865 👗 Top Class Call Gir...
(Anamika) VIP Call Girls Napur Call Now 8617697112 Napur Escorts 24x7
(Anamika) VIP Call Girls Napur Call Now 8617697112 Napur Escorts 24x7
Call Girls in Delhi, Escort Service Available 24x7 in Delhi 959961-/-3876
Call Girls in Delhi, Escort Service Available 24x7 in Delhi 959961-/-3876
Marel Q1 2024 Investor Presentation from May 8, 2024
Marel Q1 2024 Investor Presentation from May 8, 2024
👉Chandigarh Call Girls 👉9878799926👉Just Call👉Chandigarh Call Girl In Chandiga...
👉Chandigarh Call Girls 👉9878799926👉Just Call👉Chandigarh Call Girl In Chandiga...
Dr. Admir Softic_ presentation_Green Club_ENG.pdf
Dr. Admir Softic_ presentation_Green Club_ENG.pdf
Call Girls Hebbal Just Call 👗 7737669865 👗 Top Class Call Girl Service Bangalore
Call Girls Hebbal Just Call 👗 7737669865 👗 Top Class Call Girl Service Bangalore
Nelamangala Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore...
Nelamangala Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore...
Malegaon Call Girls Service ☎ ️82500–77686 ☎️ Enjoy 24/7 Escort Service
Malegaon Call Girls Service ☎ ️82500–77686 ☎️ Enjoy 24/7 Escort Service
Russian Call Girls In Gurgaon ❤️8448577510 ⊹Best Escorts Service In 24/7 Delh...
Russian Call Girls In Gurgaon ❤️8448577510 ⊹Best Escorts Service In 24/7 Delh...
Call Girls From Pari Chowk Greater Noida ❤️8448577510 ⊹Best Escorts Service I...
Call Girls From Pari Chowk Greater Noida ❤️8448577510 ⊹Best Escorts Service I...
unwanted pregnancy Kit [+918133066128] Abortion Pills IN Dubai UAE Abudhabi
unwanted pregnancy Kit [+918133066128] Abortion Pills IN Dubai UAE Abudhabi
Password War Games Webinar
1.
Password War Games
© 2012 nCircle. All Rights Reserved.
2.
Password Basics –
How Passwords are Stored ENCRYPTED PASSWORD: PASSWORD: One way Encryption bone33 6d19f07b3849a96156fe5b18733c07bb Algorithm md5 NT Hash Example: SHA-1 Account Algorithm used (1=md5 in this case) SHA-256 Salt (“R4mDH”) Blowfish jalex:$1$R4mDH$aOcFaA9.Dq6Ww2u3XmCfK/: SHA-512 14641:0:99999:7::: SHA-crypt bcrypt scrypt encrypted password © 2012 nCircle. All Rights Reserved.
3.
Basic Password Math Character
Complexity and Length Number of password • Numbers only = 10n combinations = cn • Lower case only = 26n • Mixed case = (26+26)n • Mixed case + numbers = (26+26+10)n • Mixed case + num + special = (26+26+10+30)n • All ASCII = (256)n c = number of characters in the character set, e.g. numbers = 10 n = the length of the password Special characters include the “space” character © 2012 nCircle. All Rights Reserved.
4.
Basic Password Math Examples: 141
= 103 = 1000 cat = 263 = 17,576 Cat = (26+26)3 = 140,608 C2t = (26+26+10)3 = 238,828 #2t = (26+26+10+20)3 = 551,368 ….. thecatjumpedoutofthecup = 2623 = 3,500,000,000,000,000,000,000,000,000,000,000 Character complexity is important but Length is King!! © 2012 nCircle. All Rights Reserved.
5.
Password Games Hackers
Play Password cracking techniques: – Guessing • Lists of common passwords, personal information, default passwords – Dictionary • One or more dictionaries to include foreign dictionaries – Hybrid • One or more dictionaries (plus word lists, personal information, and rules) – Brute Force • Random passwords © 2012 nCircle. All Rights Reserved.
6.
Quiz Question #1 What
is the correct ordering of password cracking techniques from most powerful to least? a. Hybrid, Brute-Force, Guessing, Dictionary b. Dictionary, Brute-Force, Dictionary, Guessing c. Brute-Force, Dictionary, Hybrid, Guessing d. Brute-Force, Hybrid, Dictionary, Guessing © 2012 nCircle. All Rights Reserved.
7.
Guessing Attacks
© 2012 nCircle. All Rights Reserved.
8.
Most Common Passwords •
These are some standard common passwords. Common passwords are the weakest of all password types. Avoid them like the plague: Common Passwords password letmein sunshine 123456 trustno1 opensesame 12345678 dragon ashley qwerty baseball passw0rd abc123 111111 shadow monkey iloveyou 123123 1234567 master 654321 Source: Splashdata annual list of worst Internet passwords © 2012 nCircle. All Rights Reserved.
9.
Default and Blank
Passwords • Many networking devices come preconfigured with “default” passwords • Many users don’t change this default password • Example: 2Wire Router – Default login user name: admin – Default password: 2Wire © 2012 nCircle. All Rights Reserved.
10.
Background Checks • Do
Not Use Personal Information — Steer clear of personal information. If the attacker knows who you are, they will have an easier time figuring out your password if it includes information such as: – Names: Your name, Pet Names, Names of family members and friends (e.g. Joshua) – Numbers: Phone numbers, addresses, social security numbers, license plate numbers, zip codes – Dates: Birth dates / anniversary dates – Favorites: Hobbies, sports teams, movie stars, colors, wine, books, cars, … © 2012 nCircle. All Rights Reserved.
11.
The Dictionary Attack
© 2012 nCircle. All Rights Reserved.
12.
Word Games • Do
Not Use Dictionary or Recognizable Words — Words such as proper names, dictionary words, or even terms from television shows or novels – guest – quartet – hogwarts – ds-9 – obiwan – spiderman © 2012 nCircle. All Rights Reserved.
13.
Foreign Language Words •
Do Not Use Words in Foreign Languages — Password cracking programs often check against word lists that encompass dictionaries of many languages. Relying on foreign languages for secure passwords is not a good practice. This includes Klingon ;-) – betenoir – bienvenido – gutenmorgen © 2012 nCircle. All Rights Reserved.
14.
Word Lists • Dictionary
attacks can be augmented by pre-built and custom word lists: – Slang – Jargon – Dirty words – Klingon, Romulan, Elvish word lists, … – Custom lists: SF 49-ers, Star Trek, Jane Austen, Marilyn Monroe word lists, rock climbing terms… © 2012 nCircle. All Rights Reserved.
15.
Double Jeopardy • Don’t
combine two words: – cathycathy – springale – realginger – elegantpresentation – scissorsauto – brokenmouse © 2012 nCircle. All Rights Reserved.
16.
Hybrid Attacks (Augmenting the
dictionary with rules) © 2012 nCircle. All Rights Reserved.
17.
Prefixes and Postfixes •
Do Not add numbers or special characters to a simple words – superman7 – nevada999 – 34phonebook – desayuno!@ – %%stockmarket © 2012 nCircle. All Rights Reserved.
18.
Inversion/Reversal • Do Not
Invert or Reverse Words — Good password checkers check for reversed words, so inverting/reversing a bad password does not make it any more secure: – etamitigel – ardnassac – nauj – 9-SD © 2012 nCircle. All Rights Reserved.
19.
Keyboard Patterns (sequences) •
Don’t use simple keyboard patterns: – 123 – 123123 – 1234567890 – qwerty – qwertyuiop – asdfghj – zaqwsx – !@#$%^&*() © 2012 nCircle. All Rights Reserved.
20.
Character Substitutions &
Leetspeak (elite speak = l33tspeak = leetspeak) Common Character Substitutions: $=S, @=A, 4=A, 1=L, 1=I, !=I, 3=E, 0=O, #=H • Examples: – PASWORD = P@$$w0rd – livefish = l!v3f1S# – ELITE = ELEET = 3L33T – n00b = newbie – Iamsurprised:-o © 2012 nCircle. All Rights Reserved.
21.
Leetspeak Table (source:
Wikipedia) © 2012 nCircle. All Rights Reserved.
22.
Don’t Make it
Up • Good password cracking programs can check many made up words using something called frequency tables. • Idea is that certain letters follow others more frequently than others in a given language • There are frequency tables for each language • Examples: – markap – yunk – quirp © 2012 nCircle. All Rights Reserved.
23.
Quiz Question #2 What
is the problem with the following password: minulauck? a. Susceptible to a dictionary cracking b. Susceptible to hybrid cracking (two words) c. Susceptible to hybrid cracking (made up word) d. Susceptible to guessing (a common word) © 2012 nCircle. All Rights Reserved.
24.
Quiz Question #3 Which
of these two passwords is weaker? a. superman56 b. Y&f2*e © 2012 nCircle. All Rights Reserved.
25.
Brute-Force Attack
© 2012 nCircle. All Rights Reserved.
26.
Brute Force Attacks •
When all else fails the cracking software will try every possible combination • Brute-force is intelligent in its search it will go in a certain order (that can be configured) • Example: – Single character, 2 character passwords, 3 character passwords, 4 digit numbers, 4 character lowercase, 4 character all character, …. © 2012 nCircle. All Rights Reserved.
27.
Letters or Numbers
Only • Do NOT use only letters or numbers: – 8675309 – miwhdd – prwlkj Length is key, but character complexity is also important in defending against Brute force attacks © 2012 nCircle. All Rights Reserved.
28.
Loose Lips Sink Ships Password
Best Practices © 2012 nCircle. All Rights Reserved.
29.
Hide & Seek •
Do Not Write Down Your Password — Never store your password on paper. Come up with a good memory scheme. © 2012 nCircle. All Rights Reserved.
30.
The Golden Password •
Do Not Use the Same Password For All Machines — i.e. This is called a gold or golden password. Crackers love them. It is important that you make separate passwords for each account. This way if one system is compromised, all of your machines/accounts/data will not be immediately at risk. © 2012 nCircle. All Rights Reserved.
31.
Password Length • Make
the Password At Least Eight Characters Long • The longer the password, the better • Most firms have a minimal acceptable length that they consider strong • Use longer passwords for more sensitive data © 2012 nCircle. All Rights Reserved.
32.
Alphanumerics • Mix Letters
and Numbers — Adding numbers to passwords, especially when added to the middle (not just at the beginning or the end), can enhance password strength. Where n = length of password Lower case alphabet = 26n combinations Alphabet + numbers = (26+10)n combinations © 2012 nCircle. All Rights Reserved.
33.
Mixed Case • Mix
Upper and Lower Case Letters — By mixing cases, you will enhance the strength of the password. Where n = length of password 26n versus (26+26)n 26 combinations of lowercase , 52 combinations of mixed case © 2012 nCircle. All Rights Reserved.
34.
Special Sauce • Including
Special characters such as &, $, #, >, … can greatly improve the strength of a password Where n = length of password Lower case only = 26n Mixed case = (26+26)n Mixed case + numbers = (26+26+10)n Mixed case + numbers + special char = (26+26+10+20)n © 2012 nCircle. All Rights Reserved.
35.
Password Pragmatism • Pick
a Password You Can Remember — The best password in the world does you little good if you cannot remember it or feel you have to write it down. • Use acronyms or other mnemonic devices to aid in memorizing passwords or use a “Password Manager” program © 2012 nCircle. All Rights Reserved.
36.
Password Checkers vs.
Password Cracking • Most password strength checkers will not discover certain types of bad passwords. • Organizations should use password cracking software as part of their audit procedures • Most password are not as sophisticated as actual password cracking programs. • Example: Procr4$tin4te i.e., a password checker might accept this password, while a good cracking program will easily break this. © 2012 nCircle. All Rights Reserved.
37.
Quiz Question #4 How
many times should you reuse a password? a. Never b. Twice c. Everywhere but your financial accounts d. Everywhere but your medical and financial accounts © 2012 nCircle. All Rights Reserved.
38.
Password Subterfuge Snooping and Social Engineering
© 2012 nCircle. All Rights Reserved.
39.
Password Acquisition Methods
(1 of 3) • Theft • Search - Passwords written down: under keyboard, on monitor, on wall, in desk drawer, under leaf of plant, under plant pot • Bribery • Coercion/Extortion/Subversion/Blackmail • Social Engineering (phishing, impersonation,…) © 2012 nCircle. All Rights Reserved.
40.
Password Acquisition Methods
(2 of 3) • Insider (admin, users, someone has access to password database) • Sniffer (to include wiretapping, rogue devices, wireless sniffing, could be insider assisted.) • Keylogger (hardware or software) • Logon spoofing (to include ATM spoofing) © 2012 nCircle. All Rights Reserved.
41.
Password Acquisition Methods
(3 of 3) • Shoulder surfing (to include hidden cameras) • Keyboard “Audio” detection • Dumpster diving • Access to password databases (safe, admin access,…) © 2012 nCircle. All Rights Reserved.
42.
Quiz Question #5 What
is the one of the most common methods that hackers use to steal passwords? a. phishing b. dumpster diving c. spamming d. breaking into your house and looking for passwords © 2012 nCircle. All Rights Reserved.
43.
Password Counter Intelligence
© 2012 nCircle. All Rights Reserved.
44.
Policies • Password Policies
– Password Use Policies • Don’t give your password to anyone • Don’t use the same password on multiple accounts • Password strength (length and character complexity) • Required use of password manager software – Logon, Aging, and Lockout Policies • Logon process should not indicate if you typed in a valid username • Delay of login response should be the same for correct and incorrect logins • Lockout policies (time and tries) • Password age • Password history © 2012 nCircle. All Rights Reserved.
45.
Checking and Auditing •
Password Checkers – Password Policy Tester – Password Defender • Password Auditing – Auditing for weak passwords using password crackers, e.g. ophcrack, John the Ripper, … – Sniffing – Physical security audits and Pen Testing © 2012 nCircle. All Rights Reserved.
46.
Multi-Factor and Non-text
Input Methods • Multiple factor authentication: – RSA tokens – Knowledge based redundancy – Smartcards – Biometrics – Location-based • Graphical passwords • Virtual keyboards © 2012 nCircle. All Rights Reserved.
47.
Defenses • Education • Do
not store or transmit passwords in the clear • Logging (login failure attempts) • Slower encryption methods (password hashing, e.g. SHA-crypt, bcrypt) • Password salts – Response to use of rainbow tables (i.e. pre-computation attacks) • Use of local parameterization • Use of password stretching (configurable iteration counts) © 2012 nCircle. All Rights Reserved.
48.
Password Manager Example:
KeePass • Easy to Use • Drag-n-drop • Hard to Get Into • Composite Master Key • Key Transformation (Stretching) • Random password Generator © 2012 nCircle. All Rights Reserved.
49.
Personal Identifiable Information
Reference • Names: (first, last, middle, maiden, hyphenated, ranks, titles), Names of relatives, friends, pets (to a lesser extent acquaintances), Nicknames • Addresses (home, addresses of relatives and friends, offices, current, old addresses, numbers, street names, city names, state names, country names) • License plate (all vehicles owned by victim to include previous vehicles) • Drivers license number (to include numbers of acquaintances) • Schools: Name of schools (elementary, middle, HS, college, fraternities, clubs) • Telephone numbers (home, cell, work, relatives, friends, office, contacts) • Social security number, account numbers, identification numbers, … • Dates: Birthday (victim, relatives, friends, pets), anniversaries (wedding, engagement, special occasion, graduation), astrological signs • Room numbers, office numbers • Clubs and military: Unit names and designations • Favorites: Colors, music groups, songs, actors/actresses, auto models, movies, books, food, wine, hobbies, sport teams,… • Web: urls of favorite sites © 2012 nCircle. All Rights Reserved.
50.
Cloud-based network security
services platform designed for small to medium enterprises nCircle PureCloud Twice the Security at Half the Cost • Enterprise-class security scanning • State-of-the-art cloud delivery • Easy to use • No hardware or software to deploy or manage © 2012 nCircle. All Rights Reserved.
51.
Questions? Continue the conversation
at http://connect.ncircle.com © 2012 nCircle. All Rights Reserved.
Jetzt herunterladen