-: Password policies. 2 2
In this lesson, we're going to examine password policies 3 3
and how they affect your IAM systems. 4 4
Now first, let's define a password policy. 5 5
A password policy is simply a policy document 6 6
that promotes strong passwords 7 7
by specifying a minimum password length 8 8
requiring complex passwords 9 9
requiring periodic password changes 10 10
and placing limits on the reuse of passwords. 11 11
Now, I know you're probably thinking, Jason 12 12
I already know all this. 13 13
I'm security plus certified. 14 14
I don't need to talk about password policies. 15 15
But wait, you really do, because there's some things 16 16
in this lesson that are going to go 17 17
against what you learned in your security plus 18 18
especially if you learned from the 501 version. 19 19
So please pay attention. 20 20
This is important and it will show up on the exam. 21 21
Now, when we talk about password protection policies 22 22
these are used to mitigate against the risk 23 23
of attackers being able to compromise an account. 24 24
Again, if you have a strong password 25 25
the chance is people aren't going to be able to break 26 26
into your system. 27 27
That's the goal here. 28 28
Now, why did I say we have to pay attention to this lesson? 29 29
Well, because there's been some big changes 30 30
in the world of password policies. 31 31
Now, if you go and look at the source documentation 32 32
which is the NIST special publication 800 - 63 B 33 33
this is the digital identity guidelines. 34 34
It talks about IAM and passwords 35 35
and they actually went and deprecated some 36 36
of the old traditional elements of password policy. 37 37
For instance, you might be familiar 38 38
with the concept of using a long, strong, complex password. 39 39
Well, now, complexity rules should not be enforced according 40 40
to this document. 41 41
Why is that? 42 42
Well, they found that when you have really 43 43
long strong passwords that are very complex 44 44
people tend to write them 45 45
down because they can't remember them. 46 46
And so if they write them down, what happens? 47 47
You now have password credentials that are out 48 48
in the open and could be retrieved by other people. 49 49
So the complexity rules should not be enforced. 50 50
Instead, you should have something between eight 51 51
and 64 ASCII characters that's really nice and long 52 52
and this can have uppercase, lowercase 53 53
and special characters if you want. 54 54
But again, if you just have a really long string 55 55
that doesn't have anything that's repetitive 56 56
like 1, 2, 3, 4, 5, 6, 7, 8, it's just as secure 57 57
and so this is a reason why they now have complexity 58 58
rules should not be enforced. 59 59
Another thing that might shock you is 60 60
that aging policies should not be enforced Now in security 61 61
plus you probably learned that you should have 62 62
people change their passwords every 60 days 63 63
and that's one of the settings that they had you memorize 64 64
inside a security plus. 65 65
But now under this new guidance 66 66
aging policies don't need to be enforced. 67 67
Why? Because again, if you're using a really 68 68
long strong password and you end up having those complexity 69 69
rules that aren't enforced, but you're using something 70 70
like a password manager, you wouldn't want to have to 71 71
change those passwords every 60 days. 72 72
The more you change them, the more people start 73 73
doing password reuse or those passwords could 74 74
become compromised. 75 75
Now, the third one is 76 76
that password hints should not be used. 77 77
Now, this isn't to say there shouldn't be a way to 78 78
reset a password, but you shouldn't have a password hint. 79 79
For instance, if my password was password 80 80
and I hit the little hint button, it says 81 81
reminder your password is pass or P, that might be 82 82
something that gives me a hint 83 83
and then I could jog my memory. 84 84
Well, that's also can jog the memory 85 85
or help a attacker guess your password. 86 86
So password hint shouldn't be used. 87 87
Instead, there should be another way to reset that password 88 88
if you forgot it. 89 89
Using things like logical information, responding 90 90
to personal information such as your first school 91 91
or your first pet's name or things like that 92 92
and then you just reset the password and choose a new one. 93 93
Now, another area 94 94
inside your password policy that you want to 95 95
consider is password reuse, because this is a big issue too. 96 96
Password reuse 97 97
across multiple sites becomes a huge vulnerability because 98 98
if somebody is able to break into a database, for instance 99 99
the Yahoo breach, and they get your password 100 100
from that because you had a Yahoo account 101 101
and they take that password now try it 102 102
on Gmail and Facebook and eBay and everywhere else 103 103
maybe if you use the same password across all those sites 104 104
now all your passwords have been compromised. 105 105
That's the idea of why you don't want to use password reuse. 106 106
Every password should be unique for every site you go to. 107 107
So how do you do all of that? 108 108
Well, the best way is to use a password manager. 109 109
A password manager should be implemented 110 110
and enforced as part of your given password policy. 111 111
Now, a password manager is a piece of software 112 112
that's used to generate a pseudo random passphrase 113 113
for each website that a user needs to log onto. 114 114
And so if I use something 115 115
as a password manager, for instance, LastPass 116 116
it will create something between eight and 64 characters. 117 117
That's a random password. 118 118
Now, I won't even know what that password is 119 119
but that's okay. 120 120
I have one master password that I use to get into LastPass 121 121
and then LastPass logs into all those websites. 122 122
For me, this is much more secure 123 123
than you trying to memorize passwords 124 124
for every single website out there. 125 125
If you're like most people 126 126
you simply can't remember all the passwords 127 127
for every website, so you either write them 128 128
down or use the same password across multiple websites 129 129
both of which are bad. 130 130
By using a password manager 131 131
you solve both of these problems. 132 132
Now, if you forget your password, what should you do? 133 133
Well, you should reset your password, right? 134 134
And when we reset our passwords 135 135
we're going to do it using one of two methods. 136 136
We can either use challenge questions 137 137
or we can use two-step verification. 138 138
Now, a challenge question is going to ask the user 139 139
for information that only they should know. 140 140
For instance, what was the first school you attended? 141 141
What was the first model of car you had? 142 142
What was the name of your first pet? 143 143
What was your first girlfriend's name? 144 144
Where was your first kiss? 145 145
Where did you meet your spouse? 146 146
Things like this. 147 147
These are questions that only you should know or maybe you 148 148
and your spouse or you and your significant other, and 149 149
so this is a way to be able to validate somebody's identity. 150 150
When you create a new account 151 151
you create a username and a password 152 152
and you add in some of these challenge questions. 153 153
Then if you need to look 154 154
up your password or reset your password 155 155
you could do that by using these challenge questions. 156 156
Now, the other way 157 157
of doing it is by using two-step verification. 158 158
Now, two-step verification is going to allow users to 159 159
provide a secondary communication channel 160 160
like another email address 161 161
or a cell phone number to receive a one-time code to 162 162
verify their identity when resetting a password. 163 163
Now, this is a great way of doing things 164 164
because when you set up the account, you said 165 165
you can trust me, I'm Jason, and my phone number is X. 166 166
Now, anytime I try to log in or reset that password 167 167
and I need that second step of verification to reset it 168 168
it will send that one-time use code to me. 169 169
If I have that phone, it now knows I am Jason 170 170
because I have my phone and I know my username. 171 171
That is two-factor authentication 172 172
and it becomes two-step verification. 173 173
In this case