1
1

00:00:00,480  -->  00:00:02,430
<v ->Password policies.</v>
2

2

00:00:02,430  -->  00:00:05,220
In this lesson, we're going to examine password policies
3

3

00:00:05,220  -->  00:00:07,980
and how they affect your IAM systems.
4

4

00:00:07,980  -->  00:00:10,290
Now first, let's define a password policy.
5

5

00:00:10,290  -->  00:00:13,020
A password policy is simply a policy document
6

6

00:00:13,020  -->  00:00:14,430
that promotes strong passwords
7

7

00:00:14,430  -->  00:00:16,740
by specifying a minimum password length
8

8

00:00:16,740  -->  00:00:18,420
requiring complex passwords
9

9

00:00:18,420  -->  00:00:20,370
requiring periodic password changes
10

10

00:00:20,370  -->  00:00:23,010
and placing limits on the reuse of passwords.
11

11

00:00:23,010  -->  00:00:24,900
Now, I know you're probably thinking, Jason
12

12

00:00:24,900  -->  00:00:26,070
I already know all this.
13

13

00:00:26,070  -->  00:00:27,660
I'm security plus certified.
14

14

00:00:27,660  -->  00:00:29,790
I don't need to talk about password policies.
15

15

00:00:29,790  -->  00:00:32,190
But wait, you really do, because there's some things
16

16

00:00:32,190  -->  00:00:33,210
in this lesson that are going to go
17

17

00:00:33,210  -->  00:00:35,490
against what you learned in your security plus
18

18

00:00:35,490  -->  00:00:38,130
especially if you learned from the 501 version.
19

19

00:00:38,130  -->  00:00:39,360
So please pay attention.
20

20

00:00:39,360  -->  00:00:41,790
This is important and it will show up on the exam.
21

21

00:00:41,790  -->  00:00:44,280
Now, when we talk about password protection policies
22

22

00:00:44,280  -->  00:00:46,110
these are used to mitigate against the risk
23

23

00:00:46,110  -->  00:00:48,840
of attackers being able to compromise an account.
24

24

00:00:48,840  -->  00:00:50,400
Again, if you have a strong password
25

25

00:00:50,400  -->  00:00:52,410
the chance is people aren't going to be able to break
26

26

00:00:52,410  -->  00:00:53,243
into your system.
27

27

00:00:53,243  -->  00:00:54,660
That's the goal here.
28

28

00:00:54,660  -->  00:00:57,720
Now, why did I say we have to pay attention to this lesson?
29

29

00:00:57,720  -->  00:01:00,150
Well, because there's been some big changes
30

30

00:01:00,150  -->  00:01:02,250
in the world of password policies.
31

31

00:01:02,250  -->  00:01:04,980
Now, if you go and look at the source documentation
32

32

00:01:04,980  -->  00:01:09,360
which is the NIST special publication 800 - 63 B
33

33

00:01:09,360  -->  00:01:11,310
this is the digital identity guidelines.
34

34

00:01:11,310  -->  00:01:13,560
It talks about IAM and passwords
35

35

00:01:13,560  -->  00:01:15,390
and they actually went and deprecated some
36

36

00:01:15,390  -->  00:01:18,210
of the old traditional elements of password policy.
37

37

00:01:18,210  -->  00:01:19,920
For instance, you might be familiar
38

38

00:01:19,920  -->  00:01:23,220
with the concept of using a long, strong, complex password.
39

39

00:01:23,220  -->  00:01:26,820
Well, now, complexity rules should not be enforced according
40

40

00:01:26,820  -->  00:01:28,020
to this document.
41

41

00:01:28,020  -->  00:01:29,100
Why is that?
42

42

00:01:29,100  -->  00:01:30,960
Well, they found that when you have really
43

43

00:01:30,960  -->  00:01:33,450
long strong passwords that are very complex
44

44

00:01:33,450  -->  00:01:34,560
people tend to write them
45

45

00:01:34,560  -->  00:01:36,030
down because they can't remember them.
46

46

00:01:36,030  -->  00:01:38,310
And so if they write them down, what happens?
47

47

00:01:38,310  -->  00:01:40,140
You now have password credentials that are out
48

48

00:01:40,140  -->  00:01:42,840
in the open and could be retrieved by other people.
49

49

00:01:42,840  -->  00:01:45,360
So the complexity rules should not be enforced.
50

50

00:01:45,360  -->  00:01:47,580
Instead, you should have something between eight
51

51

00:01:47,580  -->  00:01:50,790
and 64 ASCII characters that's really nice and long
52

52

00:01:50,790  -->  00:01:52,590
and this can have uppercase, lowercase
53

53

00:01:52,590  -->  00:01:54,210
and special characters if you want.
54

54

00:01:54,210  -->  00:01:56,460
But again, if you just have a really long string
55

55

00:01:56,460  -->  00:01:57,780
that doesn't have anything that's repetitive
56

56

00:01:57,780  -->  00:02:00,990
like 1, 2, 3, 4, 5, 6, 7, 8, it's just as secure
57

57

00:02:00,990  -->  00:02:03,420
and so this is a reason why they now have complexity
58

58

00:02:03,420  -->  00:02:05,190
rules should not be enforced.
59

59

00:02:05,190  -->  00:02:06,870
Another thing that might shock you is
60

60

00:02:06,870  -->  00:02:10,020
that aging policies should not be enforced Now in security
61

61

00:02:10,020  -->  00:02:12,060
plus you probably learned that you should have
62

62

00:02:12,060  -->  00:02:14,220
people change their passwords every 60 days
63

63

00:02:14,220  -->  00:02:16,440
and that's one of the settings that they had you memorize
64

64

00:02:16,440  -->  00:02:17,730
inside a security plus.
65

65

00:02:17,730  -->  00:02:19,890
But now under this new guidance
66

66

00:02:19,890  -->  00:02:22,110
aging policies don't need to be enforced.
67

67

00:02:22,110  -->  00:02:24,360
Why? Because again, if you're using a really
68

68

00:02:24,360  -->  00:02:27,660
long strong password and you end up having those complexity
69

69

00:02:27,660  -->  00:02:29,460
rules that aren't enforced, but you're using something
70

70

00:02:29,460  -->  00:02:31,350
like a password manager, you wouldn't want to have to
71

71

00:02:31,350  -->  00:02:33,210
change those passwords every 60 days.
72

72

00:02:33,210  -->  00:02:35,130
The more you change them, the more people start
73

73

00:02:35,130  -->  00:02:37,500
doing password reuse or those passwords could
74

74

00:02:37,500  -->  00:02:38,700
become compromised.
75

75

00:02:38,700  -->  00:02:39,780
Now, the third one is
76

76

00:02:39,780  -->  00:02:42,210
that password hints should not be used.
77

77

00:02:42,210  -->  00:02:44,310
Now, this isn't to say there shouldn't be a way to
78

78

00:02:44,310  -->  00:02:47,460
reset a password, but you shouldn't have a password hint.
79

79

00:02:47,460  -->  00:02:49,890
For instance, if my password was password
80

80

00:02:49,890  -->  00:02:51,750
and I hit the little hint button, it says
81

81

00:02:51,750  -->  00:02:55,740
reminder your password is pass or P, that might be
82

82

00:02:55,740  -->  00:02:56,700
something that gives me a hint
83

83

00:02:56,700  -->  00:02:58,170
and then I could jog my memory.
84

84

00:02:58,170  -->  00:03:00,030
Well, that's also can jog the memory
85

85

00:03:00,030  -->  00:03:01,950
or help a attacker guess your password.
86

86

00:03:01,950  -->  00:03:03,450
So password hint shouldn't be used.
87

87

00:03:03,450  -->  00:03:06,300
Instead, there should be another way to reset that password
88

88

00:03:06,300  -->  00:03:07,350
if you forgot it.
89

89

00:03:07,350  -->  00:03:09,990
Using things like logical information, responding
90

90

00:03:09,990  -->  00:03:12,090
to personal information such as your first school
91

91

00:03:12,090  -->  00:03:14,640
or your first pet's name or things like that
92

92

00:03:14,640  -->  00:03:16,830
and then you just reset the password and choose a new one.
93

93

00:03:16,830  -->  00:03:17,663
Now, another area
94

94

00:03:17,663  -->  00:03:19,170
inside your password policy that you want to
95

95

00:03:19,170  -->  00:03:22,560
consider is password reuse, because this is a big issue too.
96

96

00:03:22,560  -->  00:03:23,400
Password reuse
97

97

00:03:23,400  -->  00:03:27,060
across multiple sites becomes a huge vulnerability because
98

98

00:03:27,060  -->  00:03:29,730
if somebody is able to break into a database, for instance
99

99

00:03:29,730  -->  00:03:31,620
the Yahoo breach, and they get your password
100

100

00:03:31,620  -->  00:03:33,390
from that because you had a Yahoo account
101

101

00:03:33,390  -->  00:03:34,950
and they take that password now try it
102

102

00:03:34,950  -->  00:03:38,430
on Gmail and Facebook and eBay and everywhere else
103

103

00:03:38,430  -->  00:03:40,920
maybe if you use the same password across all those sites
104

104

00:03:40,920  -->  00:03:43,200
now all your passwords have been compromised.
105

105

00:03:43,200  -->  00:03:45,810
That's the idea of why you don't want to use password reuse.
106

106

00:03:45,810  -->  00:03:48,990
Every password should be unique for every site you go to.
107

107

00:03:48,990  -->  00:03:50,820
So how do you do all of that?
108

108

00:03:50,820  -->  00:03:53,310
Well, the best way is to use a password manager.
109

109

00:03:53,310  -->  00:03:55,020
A password manager should be implemented
110

110

00:03:55,020  -->  00:03:57,750
and enforced as part of your given password policy.
111

111

00:03:57,750  -->  00:03:59,640
Now, a password manager is a piece of software
112

112

00:03:59,640  -->  00:04:02,040
that's used to generate a pseudo random passphrase
113

113

00:04:02,040  -->  00:04:04,500
for each website that a user needs to log onto.
114

114

00:04:04,500  -->  00:04:06,060
And so if I use something
115

115

00:04:06,060  -->  00:04:08,430
as a password manager, for instance, LastPass
116

116

00:04:08,430  -->  00:04:11,040
it will create something between eight and 64 characters.
117

117

00:04:11,040  -->  00:04:12,660
That's a random password.
118

118

00:04:12,660  -->  00:04:14,400
Now, I won't even know what that password is
119

119

00:04:14,400  -->  00:04:15,420
but that's okay.
120

120

00:04:15,420  -->  00:04:18,540
I have one master password that I use to get into LastPass
121

121

00:04:18,540  -->  00:04:20,730
and then LastPass logs into all those websites.
122

122

00:04:20,730  -->  00:04:22,710
For me, this is much more secure
123

123

00:04:22,710  -->  00:04:24,057
than you trying to memorize passwords
124

124

00:04:24,057  -->  00:04:25,800
for every single website out there.
125

125

00:04:25,800  -->  00:04:26,790
If you're like most people
126

126

00:04:26,790  -->  00:04:28,590
you simply can't remember all the passwords
127

127

00:04:28,590  -->  00:04:30,570
for every website, so you either write them
128

128

00:04:30,570  -->  00:04:33,840
down or use the same password across multiple websites
129

129

00:04:33,840  -->  00:04:34,980
both of which are bad.
130

130

00:04:34,980  -->  00:04:36,210
By using a password manager
131

131

00:04:36,210  -->  00:04:38,130
you solve both of these problems.
132

132

00:04:38,130  -->  00:04:40,830
Now, if you forget your password, what should you do?
133

133

00:04:40,830  -->  00:04:43,110
Well, you should reset your password, right?
134

134

00:04:43,110  -->  00:04:44,400
And when we reset our passwords
135

135

00:04:44,400  -->  00:04:46,980
we're going to do it using one of two methods.
136

136

00:04:46,980  -->  00:04:48,750
We can either use challenge questions
137

137

00:04:48,750  -->  00:04:50,820
or we can use two-step verification.
138

138

00:04:50,820  -->  00:04:53,040
Now, a challenge question is going to ask the user
139

139

00:04:53,040  -->  00:04:55,050
for information that only they should know.
140

140

00:04:55,050  -->  00:04:57,480
For instance, what was the first school you attended?
141

141

00:04:57,480  -->  00:04:59,580
What was the first model of car you had?
142

142

00:04:59,580  -->  00:05:01,380
What was the name of your first pet?
143

143

00:05:01,380  -->  00:05:03,210
What was your first girlfriend's name?
144

144

00:05:03,210  -->  00:05:04,650
Where was your first kiss?
145

145

00:05:04,650  -->  00:05:06,150
Where did you meet your spouse?
146

146

00:05:06,150  -->  00:05:07,230
Things like this.
147

147

00:05:07,230  -->  00:05:09,780
These are questions that only you should know or maybe you
148

148

00:05:09,780  -->  00:05:12,180
and your spouse or you and your significant other, and
149

149

00:05:12,180  -->  00:05:15,240
so this is a way to be able to validate somebody's identity.
150

150

00:05:15,240  -->  00:05:16,650
When you create a new account
151

151

00:05:16,650  -->  00:05:18,180
you create a username and a password
152

152

00:05:18,180  -->  00:05:20,820
and you add in some of these challenge questions.
153

153

00:05:20,820  -->  00:05:21,990
Then if you need to look
154

154

00:05:21,990  -->  00:05:24,270
up your password or reset your password
155

155

00:05:24,270  -->  00:05:26,730
you could do that by using these challenge questions.
156

156

00:05:26,730  -->  00:05:27,563
Now, the other way
157

157

00:05:27,563  -->  00:05:29,880
of doing it is by using two-step verification.
158

158

00:05:29,880  -->  00:05:32,550
Now, two-step verification is going to allow users to
159

159

00:05:32,550  -->  00:05:34,740
provide a secondary communication channel
160

160

00:05:34,740  -->  00:05:36,030
like another email address
161

161

00:05:36,030  -->  00:05:39,000
or a cell phone number to receive a one-time code to
162

162

00:05:39,000  -->  00:05:41,550
verify their identity when resetting a password.
163

163

00:05:41,550  -->  00:05:43,560
Now, this is a great way of doing things
164

164

00:05:43,560  -->  00:05:45,430
because when you set up the account, you said
165

165

00:05:45,430  -->  00:05:49,860
you can trust me, I'm Jason, and my phone number is X.
166

166

00:05:49,860  -->  00:05:52,320
Now, anytime I try to log in or reset that password
167

167

00:05:52,320  -->  00:05:54,870
and I need that second step of verification to reset it
168

168

00:05:54,870  -->  00:05:57,150
it will send that one-time use code to me.
169

169

00:05:57,150  -->  00:05:59,940
If I have that phone, it now knows I am Jason
170

170

00:05:59,940  -->  00:06:02,940
because I have my phone and I know my username.
171

171

00:06:02,940  -->  00:06:04,410
That is two-factor authentication
172

172

00:06:04,410  -->  00:06:06,120
and it becomes two-step verification.
173

173

00:06:06,120  -->  00:06:06,953
In this case