ITPRO - UK - July 19, 2010-

Is your password really as secure as you think it is? Davey Winder investigates.

So you think you know what a secure password is? Think again. No, seriously. The chances are that the hackers are way ahead of you in terms of truly understanding secure password construction, and more importantly password deconstruction methods as well.

Brute forcing tools abound, which use both dictionary and hybrid dictionary methods to break the kind of password that many think are impervious to such automated breakage. Simply not using dictionary words is no longer protection enough, hackers can crack substitutions such as P455w0rd! instead of password in a matter of minutes. So what does constitute a secure password these days then?

Secure password construction

Current thinking dictates that a secure password needs to be not just eight characters in length anymore, but at least 12. Current thinking also dictates that in order for an enterprise to successfully implement a secure password solution it must consider three parameters: the level of security, the cost implication and user-friendliness.

The last of these is often overlooked, and that's a big mistake as Jan Valcke, president and chief operating officer (COO) at VASCO Data Security, reminds us that "attention must be paid to ensure that extreme password complexity rules don’t break the overall security of the scheme because users start writing down passwords".

But how can you build complex passwords that are at least 12 characters long, include special characters and are not dictionary words, without breaking that user friendly rule?

Rik Ferguson, senior security advisor at Trend Micro, suggests you think of a memorable phrase such as "Motley Crue and Adam and the Ants were the soundtrack of my youth" and then take the initial letters to form MCAAATAWTSOMY. "This will be the basis of the password" Ferguson advises "but we need to make sure to a mix of upper and lower case characters, numbers and special characters".

So mixing cases gives us McaAatAwTsomY, changing the o to an 0 produces McaAatAwTs0mY and finally the special characters are introduced by changing the first 'and' into + and the second to & which gives us Mc+A&tAwTs0mY. Ferguson recommends using the £ symbol as it's overlooked by many brute force tools, so the final password would be: Mc+A&tAwTs0mY£

David Emm, a member of the global research and analysis team at Kaspersky Lab, has a solution to the problem of remembering how you've constructed a password: instead of using the same word each time, apply a uniform set of rules every time instead. "All you have to remember is your method" Emm explains. Using the name of a couple of online resources as examples, Amazon and YouTube, and applying the memorable phrase technique with 'the quick brown fox jumps over the lazy dog' as an example to give us a password core of 'tqbfjotld' you could apply the following four step method:

1. Capitalise the fourth character.

2. Add a numeric character after the second character.

3. Add a non-alpha-numeric character to the end.

4. Put the last character of the online resource you're logging into at the beginning.

So Amazon gets a password of Nt2qbFjotld£ while YouTube gets Et2qbFjotld£ which are both unique and difficult to guess, or crack using brute force tools, but despite the complex appearances are easy to remember as it's the methodology that sticks in the memory.

Strategic thinking

It's important not to forget that password policies, and the processes in place around them, are just as crucial as the secure nature of the password themselves. As Greg Day, director of security strategy at McAfee (EMEA), reminds us "It is important that enterprises ensure that workers refresh their passwords periodically, but as with any area of data security, excessive changes lead to a greater risk of human error".

What the enterprise has to do is get the balance right. Unfortunately all too often what happens is they introduce complex password policies leading to an increase in costs courtesy of IT support calls and lost productivity, and an increase in risk as users write passwords down or use the same one for every resource.

The answer is for password protection to be considered and a serious business issue by everyone in the enterprise, rather than a hindrance.

"This is where good communication comes into play" says Richard Hunt, managing director of Turnkey Consulting, adding "if staff understand why secure passwords are so important, and the potential implications for the organisation if they are not, it will make it easier to implement a policy and foster a secure password culture".

In the end, what makes implementing a successful secure password management strategy is actually having a strategy in the first place insists Kevin Bocek, director at IronKey. "While it may seem simple" Bocek tells us "it’s most important to have a password management strategy and policy of some sort that's actually implemented and enforced even though it’s not perfect".

At the smaller end of the enterprise scale, this is often still not yet accomplished. But with the Information Commissioner's Office placing the spotlight on data breaches, many organisations of all sizes have started encrypting mobile data.

"Without being able to enforce and report on encryption use, including the type and quality of passwords used for unlocking encryption keys" Bocek warns "escaping a fine that can reach £500,000 could provide difficult".

Which is where a Continuous Controls Monitoring (CCM) solution can be useful, suggests Richard Hunt.

"CCM provides users with real-time status assurances for all of their compliance control points" he explains "a rule can be configured that triggers an automatic and regular review of password complexity to ensure that user passwords contain enough variation in terms of numbers and upper and lowercase letters". Any exceptions will be automatically flagged in the control output and then reviewed by the IT Admin for relevant action.

Secure or not secure?

So what makes a truly secure password? Jason Hart, an ex-ethical hacker and now vice president of security at CRYPTOCard has a very straight response to the question: nothing makes a password truly secure!

"Passwords are the softest security target" Hart warns "and until people and organisations start adopting strong authentication in the form of, for instance, two-factor authentication this problem won’t go away".

Sadly, of course, he is right. Which is why many enterprises are now combining something you have (such as a smartcard or USB stick with a one time password function) with something you know (a PIN) to secure their networks instead.

Read Article Here.