Password Policy - What do you think?
Traditionally all of us have been taught that password policies are a must along with the thought that passwords must be changed on a regular basis. This even comes up in the CISSP exam. When you look at how a security team operates, those that are considered excellent and cutting edge all have a password policy that always includes some kind of periodic forced password change.
I'm going to throw something out there and see what you all think. Let's say that I have had a brick fall on my head and I decide that security is more a human-centric issue than a technical issue. Now, since the bump on my head is really big, I determine that if I make my alpha passwords with special characters too confusing, my end users are going to write them down or store them somewhere without the slightest bit of protection.
Since we're sure that I'm completely mad at this point, I will also tell you that I have decided that my alpha special character passwords that are at least 7 characters long will resemble normal words instead of crypto-babble. On top of this madness, if I can determine that current cracking technology cannot crack these common phrase passwords in my lifetime or the next and I know that my end users will not write these passwords down because they can easily remember them, I am no longer going to force periodic password changes (outside of terminations and personnel turnover to key assets if they are admins or the like).
Now that I have exposed the mania that has come over me, am I less, more or equally secure as those who implement traditional password policies as I have outlined here?
Now, before I lay down my cards, let's see what all of you have to say. ;)
Re: Password Policy - What do you think?
Quote:
Since we're sure that I'm completely mad at this point, I will also tell you that I have decided that my alpha special character passwords that are at least 7 characters long will resemble normal words instead of crypto-babble. On top of this madness, if I can determine that current cracking technology cannot crack these common phrase passwords in my lifetime or the next and I know that my end users will not write these passwords down because they can easily remember them, I am no longer going to force periodic password changes (outside of terminations and personnel turnover to key assets if they are admins or the like).
Im not sure, but I thought there was a password cracker that would use leet speak type of words along with the traditional dictionary type of crack.
So according to this, an accepted password for this scheme could be D0ct3r007 or iLik3ch33s3 or Ou812sodIdi
Interesting. Please keep us posted on your experiment.
~Halv