In this lesson,
we're going to discuss password security.
Password security is a measure of the effectiveness
of a password in resisting guessing and brute-force attacks.
In this user form,
password security is used to estimate
how many attempts an attacker
who does not have direct access to the password
may receive to guess it correctly.
For us to create our password policies,
we're going to use the group policy editor.
I'm using a Windows 11 machine here
on a local computer network that's not part of domain.
Using a domain environment,
you can use your global policy orchestrator,
but for a local machine,
we're going to stick with the local group policy editor.
Now, to do this,
we're going to simply search "gpedit"
in the search bar at the bottom.
Now on the screen,
we just need to go
to the Computer Configuration setting at the top,
and then we're going to click the Windows Setting.
Next we're going to go to the Security Settings,
Account Policies, and then Password Policy.
Now, you'll see that there are several different settings
here that relate to the five characteristics
that you need to consider when managing
your organization's password policies,
including password length, password complexity,
password reuse, password expiration, and the password age.
First, we have the password length.
The longer password is, the harder it will be to crack.
For best security,
your password should be at least 12
to 16 characters in length.
After all, the longer the password
and an attack method that says
a lot more different passwords,
which will ultimately slow down their ability
to compromise your password.
For example, if we use a simple seven-letter word
of pencils as our password,
this will only take about 0.4 seconds
to crack it in a modern laptop.
But if we were to change it
to something like PencilsAreForWriting,
then now that's 20 characters
and it would take about two months if we were conducting
a brute-force attack on a modern laptop.
Length is an important characteristic of strong password
because every additional character
exponentially increases your password security.
For example,
let's take this simple example
of creating a pin to protect your smartphone.
Most smartphones will let you set a PIN
either four, five, six, seven, or eight digits in length.
If we opt to only use a four-digit PIN,
we only have 10,000 possible combinations,
ranging from 0000 to 9,999.
This is because a PIN can only have the digits zero to nine,
which gives us 10 options per digit chosen.
So if we choose a four-digit PIN,
we have 10 times 10, times 10, times 10,
or 10 to the fourth power, or 10,000 options.
If I simply add one more digit to the chosen five-digit pin,
I will have increased the password length by just one digit,
but now I have expanded my options
from 10 to the fourth power to 10 to the fifth power,
or 100,000 choices.
If I continue to add another digit,
each digit will add 10x more choices for us.
So if we opt for the maximum pin size of eight digits,
this gives us 100 million choices.
Now, you can see though,
even though we've only doubled our length
from four to eight digits,
we actually increase our possible PIN choice
from 10,000 choices to 100,000,000 choices,
which is 10,000 times more options
by simply adding four more digits to our password length.
This is why we say increasing length
is increasing your security.
For this example, we will set it to 14.
To adjust it to higher than that,
we must change the relaxed minimum password length limits,
which is there to help with compatibility in legacy systems.
Let's go to minimum password length, 14, Apply.
Now just to point out,
what was I referencing
about the relaxed minimum password length?
There's this option here.
As you read it, has a little warning though,
saying, "Modifying this setting may affect compatibility
with clients, services, and applications."
So in order to change this, you must enable it.
Now, when you enable it,
it allows you to increase the password length
beyond the 14 characters.
If you click this Explain, they give you more details here.
Second, we need to consider the password complexity.
Password complexity refers to the use of a combination
of uppercase and lowercase letters, numbers,
and special characters in the password.
The more complex the password,
the harder it will be to guess using a brute-force attack.
If we use a PIN,
we only have 10 character choices
that we can use for each digit of a PIN
because each digit can either be zero, one,
two, three, four, five, six, seven, eight, or nine.
So if I use a four-digit password only using numbers,
then I have 10,000 possible choices
or 10 times 10, times 10, times 10.
Now, if I wanted to use lowercase letters instead
and still use a four-character password,
I would have 26 letter options for each character
or 26 times 26, times 26, times 26,
which equals 456,976 choices.
So just switching from numbers to lowercase letters
gives me more than a 40x the number
of possible four-character passwords.
But if we add in uppercase,
we move the 26 choice options to 52 options per character.
For a four-character password,
this gives us 52 to the power of four
or 7,311,616 choices,
which is now 731 times more options
than our original four-digit PIN.
But in most of our modern authentication systems,
we don't just use letters or numbers.
We use lowercase letters, uppercase letters,
numbers, and special characters.
This means that we have 26 lowercase letters,
26 uppercase letters, 10 numbers,
and usually around 10 special characters,
like the plus sign, minus sign, period, exclamation point,
hashtag, asterisk, and things like that.
So if we use all four of these character types,
we no longer just have 10,000 combination
using our four-digit numeric password,
but we can now have a password like aW3+,
which is considered to be complex
since it has lowercase letter, an uppercase letter,
a number and a special symbol.
This gives us 72 characters that could be used
in each of the four characters in the password,
or 72 to the fourth power,
which is 26,873,856.
This is 2,687 times more secure
and complex than using just a four-digit PIN.
So instead of using a long string of dictionary words
like PencilsAreForWriting that would only take
about two months to crack using a brute-force attack,
we could change out some of the letters
for numbers and add a special character to,
such as p3nc
1l5Ar3
F0r
Wr1
t1ng!
which would take about 15 years to crack
using a brute-force technique on a modern laptop.
Now to demonstrate this,
we're simply just going
to enable the password complexity requirements.
Windows has a built in default complexity requirement
that you don't have to configure specifically.
So if you go to explanation, here are the rules here.
Okay? All right.
Third, we have to consider password reuse.
Password reuse is the practice of using the same password
across multiple different accounts or applications,
which increases vulnerabilities
because one compromised password can lead
to multiple accounts being breached.
You should always avoid reusing
passwords across different accounts.
Another way that people consider a password to be reused
is if a formal password is used again
with the same application or website.
For example,
if you tried to log into Facebook this morning
but you forgot your password,
you may well need to change it.
Now, let's pretend your original password,
which you forgot, is Password1.
Well, using the password reset function,
you choose a new password,
and we'll call this Password2 for our example.
A few weeks go by and you forgot your password again,
so you reset it to Password3.
Now, you really want to set
your password back to Password1,
but the system is designed to remember your password history
and it won't let you reuse the same password,
Password1, in this case,
until you have changed your password at least five times.
This is known as the password history
or number of new passwords that must have been created
before you can reuse an older password.
I have seen many people who really, really want
to set their password back to the same one,
and what they will usually do in this situation
is simply reset their password five times
until they can rotate back to their original password.
The problem with this is if the password is
more than 90 days old,
it has a very high chance of being cracked by an attacker.
Many times,
password cracking can take anywhere
from three to six months depending on the password strength.
So if you recycle an old password,
the attacker may have been able
to crack it since you last used it,
and you're now going to be vulnerable to that attack again.
Now, to do that,
we're going to simply go to the enforce password history,
and we're going to set it to the maximum, which is going to be 24.
So that means that a user will have
to reset their password 24 times
before they can use the original password.
Fourth, we have password expiration.
Password expiration is a policy that requires users
to change their password after a certain period.
For instance,
a company might have a policy that requires all employees
to change their password every 90 days.
When the 90 day period is up,
the password expires and a new one must be set.
However, this practice is being reconsidered
as it often leads to poor passwords,
since many people have difficulty remembering
a lot of long, strong and complex passwords.
So they tend to reuse the same one across multiple sites
or simply do some keyboard walking
to add something to the end of some basic password.
For example,
you might use DionTraining1 as your first password,
then DionTraining2 as your next password in 90 days,
then DionTraining3 as your third password,
and so on and so forth.
For this reason,
the National Institute of Standard and Technology or NIST
no longer recommends password expiration policies
to be implemented in most organizations
unless you are already forcing the use
of password managers across your organization
to securely track all of your long, strong,
and complex passwords for each website and application.
To configure the password expiration,
we're simply going to go to maximum password age,
and we're just going to set it to 90 days.
Fifth, we have password age.
Password age refers to the length
of time a password has been in use.
Now, the minimum password age refers to the shortest period
of time within which a user is disallowed
from changing their password again
after it has been changed.
This policy prevents users
from rapidly cycling through password changes
in attempt to revert back to their old,
more familiar password.
For example, without minimum password age,
a user might change their password multiple times
within a few minutes,
effectively bypassing the system's password history
and using their initial password again.
By setting a minimum password age,
such as one or a few days,
organizations can assure that once passwords are changed,
they stay changed for a reasonable period,
further bolstering security.
This policy combined with an enforced password history
deters users from frequently alternating
between a small set of familiar passwords
and encourages the adoption
of newer, secure passwords over time.
Now, to do that,
we're going to simply configure the minimum password age,
and we're going to change it to least, just say three days.
So this simply means that a user cannot change
their password unless it's been three days.
Now that we have seen the five different characteristics
that you should consider
in your organization's password policies
such as password length, password complexity,
password reuse, password expiration, and password age,
to help our organization's increase
their overall password security,
they should implement and utilize a secure password manager
for their end users.
Password managers are tools that store and manage
all your passwords in one centralized location for you
by generating a strong and unique password
that then automatically fills them
into a website or application for you
whenever you attempt to log in.
Password managers have some key features
that make them an essential security tool
for your organization, including password generation,
autofill, secure sharing, and cross-platform access.
First, we have password generation.
Most password managers can generate strong, random,
and unique password for each of your accounts,
which helps in maintaining password complexity
and avoiding password reuse.
When you need to create a new password,
you can specify the policy to use
such as numbers only, alphanumeric,
or with special characters,
along with the length and complexity requirements
that the website or application requires for its passwords.
Second, we have autofill.
Password managers can automatically fill in
your username and password when you visit a site,
which can save you from the hassle
of remembering and typing them in yourself.
This also decreases the chance of human error.
Third, we have secure sharing.
If you need to share a password with someone,
password managers can often do this in a secure way
without revealing the password itself.
For example, if I have a personal assistant
and I need for them to be able
to log into my email on my behalf,
I could give them permissions
in my password manager to log in as me,
but the password manager
will actually do the logging in on their behalf
and it would never show them the password
being used during a login process.
Fourth, we have the cross-platform access.
Most password managers are available
across multiple devices and platforms,
which ensures that you have access
to your passwords wherever you are.
For example, I personally use Bitwarden
and I have it installed on my laptop,
my Google Chrome browser, as an extension,
and on my smartphone.
That way, no matter where I am,
I can access my passwords within Bitwarden
on any device that I'm logging into.
Lastly, we need to discuss passwordless authentication,
which has become a very popular
new method of authentication.
Passwordless authentication methods
are increasingly being used
because they provide us with a higher level of security
and a better user experience.
This passwordless authentication can be achieved
through biometric authentication.
Some trusted password managers include 1Password,
Bitwarden and Dashlane,
but there are many others on the market as well.
Hardware tokens, one-time password,
magic links, and passkeys.
Biometric authentication uses
unique biological characteristics,
such as fingerprints, facial recognition,
or iris scans to verify identity.
If you use your fingerprint or your face
to authenticate or unlock a device,
that will be considered biometric authentication.
Hardware tokens use physical devices, like a security key,
that generate a short duration and ever-changing login code.
A one-time password or OTP is a code
that is sent your email or phone,
which you can enter to log in.
The code is usually valid for only a short period of time,
maybe like 3 to 10 minutes,
and it can only be used once to log in.
After that, a new code would need to be requested
when you want to log in again.
A magic link is a link that is sent to your email.
By clicking the link,
you're automatically logged into that website.
This link is also valid for a short period of time
and can only be used once,
similar to a one-time passcode.
A passkey serves as an authentication tool
that integrates with the browser or operating system.
When set up, users are prompted to establish a passkey.
Instead of remembering and typing passwords,
users utilize their device's built-in security feature,
such as a fingerprint sensor.
When logging into a site or application,
users are asked to unlock the device
using the chosen method.
Once unlocked,
the device fetches its securely stored passkey
and presents it to the site or application,
verifying the user identity and granting access.
So remember, when it comes to passwords,
the longer your password, the more time it will take crack.
Password complexity evolves the use of a mix of letters,
numbers, and special characters.
You also should never reuse passwords,
and each of your accounts should have
its own unique password.
Also, your organization should consider using
a password manager to help manage your passwords effectively
and explore passwordless options too if they're available,
since they provide higher security
and a better overall user experience.