©2002 techrepublic, inc. . all rights reserved. information security don’t be the weakest link or...

©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved.

Information Security

Don’t Be the Weakest Linkor

“But, I use a password!!”


A Matter of Balance

There is an inverse relationship between convenience (ease-of-use) and security.

As you increase security, you lose convenience.

Convenience

Security


What is Security?

Webster’s Dictionary: Measures taken to guard against espionage or sabotage, crime, attack, or escape

H. Stanley Judd: The ultimate security is your understanding of reality.


Threat Categories Natural Disasters – Fire, flood, tornado, etc. Nonhuman – Product failures, bugs, etc. Human

☹Malicious:

Insiders – Disgruntled employees

Outsiders – Hackers, crackers, etc.

☹ Nonmalicious: Untrained or uninformed employees


One of the Company’s Most Valuable Assets

The information stored in computer files on our desktop computers and on the local area network


Profiles: Who’s Breaking In?

Corporate spies

Governments

Terrorists

Career criminals

Insiders

Financial, competitive gain

National interests

Religious, political ideals

Financial, control/power

Financial, revenge


What Makes Us Vulnerable? Easily guessed passwords – Too short;

too simple; common words Not keeping secrets – Writing passwords down;

sending confidential data in e-mails Trusting things we get from others – Opening

e-mail attachments that have a virus or other malicious code


Password A string of characters, entered to verify that you

are authorized to access computer resources, consisting of:

Alphabetic – A to Z and a to z Numeric – 0 to 9 Special Characters – ~; !: @; #; $; %; ^; &; *;

(; ); +; =; [; ]; {; }; /; ?; <; >; ,; ;; :; \; |; `; ’; ”; .


Problems with Passwords There is a direct relationship between the ease

with which a password can be remembered and the ease with which it can be guessed.

Without a gimmick, a password that is difficult for an unauthorized person to guess is usually difficult for a user to remember (more about gimmicks later).

If a password is easy to remember, it is probably easy for someone else to guess.


Password Security Don’t tell anyone your password. Don’t write your password down anywhere. Make sure your password cannot be easily

guessed. If you think there is even a slight chance

someone knows your password, change it. Don’t let someone see what you are

entering as your password.


Don’tDon’t Choose a WeakWeak Password: With fewer than eight characters. That could be found in a dictionary. That uses public information about you or your

family or friends (Soc Sec #; birthdate; credit card number; telephone number, etc.).

That you have used before. That is a variation of your user ID. That is something significant about you.


DoDo Choose a StrongStrong Password: That is at least eight characters long. That contains uppercase and lowercase letters. That contains at least one number or special

character. That is not a dictionary word in any language,

slang, or jargon. That cannot be easily guessed and is easy to

remember.Remember to change your password every 90 days.


WeakWeak Passwords (examples):

cat dog diego querty hart heat heart mary 1dennis2 hartelephone lintelco hartwell eednyw ydnew kayak palindrome september superman mickeymouse r2d2 aaaabbbccd 12345678 a1b2c3d4 zxcvbnm bonvoyage mercibeaucoup volkswagen mircrosoft colorprinter windows98 nowisthetimeforallgoodmentocometotheaid


StrongStrong Passwords (examples):

Wwe&nadtd2BoN2bTist? IsfgaWDo6 3bmstfw1491 Mdi#1imh 52eobbowtffcd tmb1W2rpwmkrG8b$

I know what you are thinking:

“Wait one minute, you geek – you said it must be easy to remember!”

Let me explain mnemonics.mnemonics.


Mnemonics Mnemonics Made Easy Take a phrase that is easy for you to remember

and convert it into characters. It could be the first line of a poem or a song lyric. “Water, water everywhere and not a drop to

drink” (Rhyme of the Ancient Mariner) converts to Wwe&nadtd.

“We Three Kings from Orient Are” converts to w3KfOr3691.

(3691 is the year 1963 spelled backward to extend beyond six characters.)


Protect the Security of the Company’s Information As If Your Job Depends on It, Because…

IT DOES!

©2002 techrepublic, inc. . all rights reserved. information security don’t be the weakest link or...

Documents

password security dont

ultimate security

special characters

weak passwords examples

convenience ease

websters dictionary

information securitydont

dictionary word