Password Complexity is Essential For Your Organization’s Application Security
Passwords are the most common method (along with user accounts) for authenticating a person in order to identify them as someone allowed access to the system and company network. This is especially true within networks where multiple platforms exist (such as Windows, Linux and Apple iOS) because not all systems support more advanced authentication devices.
Password complexity offers a very simple method of identification by requiring the user to provide only something that they know, in this case a “secret” known only to the user and the system to which they are authenticating. However, several factors now make passwords a very weak method of protecting systems from unauthorized access.
First, attackers can break passwords with enough time and the right tools. Today’s faster processors enable malicious attackers to crack passwords (even those with strong encryption) in hours or even minutes, depending upon the nature of the password. While this is more of a technology vulnerability, it is important to mention because of the next point. In order to prevent successful password cracking, administrators can enforce password complexity rules. These rules, when configured on systems, force users to create passwords that meet specific constraints designed to ensure that passwords cannot be cracked within a short period of time.
Rules typically include length of password (over 12 characters), and require passwords to include one or more numbers, special characters, lowercase letters and upper case letters. The problem with passwords and personnel is that complex passwords are difficult to remember. For this reason employees will write down the passwords (which may eventually be found by others) or create passwords that, in spite of the complexity rules, certain password cracking software such as “John the Ripper” can break by using familiar names, repeat characters, phone numbers, the address of the company, or other human predictable password choices.
John the Ripper and other similar password cracking software packages able to break passwords faster because they support the use of (human predictable) password lists that the software can try first before proceeding into brute force cracking mode (essentially guessing at high-speed). Through the use of such lists, password cracking time is greatly reduced unless additional password complexity rules (such as disallowing use of dictionary words) are strictly enforced.
Of course password complexity rules do not prevent users from writing down their passwords, eventually retrievable through “dumpster diving” if and when the paper containing their passwords ends up in the trash bin.
Password Complexity ni muhimu kwa usalama wa maombi ya shirika lako: Nenosiri ni njia ya kawaida (pamoja na akaunti za mtumiaji) kwa uthibitisho wa mtu ili kumtambua kama mtu aliyeruhusiwa kuingia kwenye mfumo na mtandao wa kampuni. Hii ni kweli hasa ndani ya mitandao ambapo majukwaa mbalimbali zipo (kama vile Windows, Linux na Apple iOS) kwa sababu si mifumo yote kusaidia vifaa vya uthibitisho zaidi ya juu. Uwezo wa password hutoa njia rahisi sana ya utambulisho kwa kuhitaji mtumiaji kutoa kitu tu wanachojua, katika kesi hii "siri" inayojulikana tu kwa mtumiaji na mfumo ambao wanathibitisha. Hata hivyo, mambo kadhaa sasa hufanya nywila kuwa njia dhaifu sana ya kulinda mifumo dhidi ya upatikanaji usioidhinishwa. Kwanza, washambuliaji wanaweza kuvunja nywila kwa wakati wa kutosha na zana sahihi. Wasindikaji wa leo wa haraka huwezesha washambuliaji wenye madhara kuvunja nywila (hata zile zilizo na encryption kali) kwa masaa au hata dakika, kulingana na asili ya nywila. Wakati hii ni zaidi ya teknolojia ya udhaifu, ni muhimu kutaja kwa sababu ya uhakika ujao. Ili kuzuia mafanikio password cracking, wasimamizi wanaweza kutekeleza password utata sheria. Kanuni hizi, zinapowekwa kwenye mifumo, huwafanya watumiaji wafanye nywila ambazo zinakidhi vizuizi maalum vilivyopangwa kuhakikisha kwamba nywila haziwezi kuvunjwa ndani ya kipindi kifupi cha wakati. Kwa kawaida, sheria zinajumuisha urefu wa nywila (zaidi ya herufi 12), na zinahitaji nywila kujumuisha nambari moja au zaidi, herufi maalum, herufi ndogo na herufi kubwa. Tatizo la kutumia nywila na watu ni kwamba nywila ngumu ni vigumu kukumbuka. Kwa sababu hii, wafanyakazi wataandika pasi (ambayo inaweza hatimaye kupatikana na wengine) au kuunda pasi ambazo, licha ya sheria za utata, programu fulani ya kuvunja password kama vile John the Ripper inaweza kuvunja kwa kutumia majina ya kawaida, herufi za kurudia, nambari za simu, anwani ya kampuni, au chaguzi nyingine za siri za binadamu. John the Ripper na programu nyingine zinazofanana za kuvunja nywila zinaweza kuvunja nywila haraka kwa sababu zinaunga mkono matumizi ya orodha za nywila ambazo programu inaweza kujaribu kwanza kabla ya kuendelea katika hali ya kuvunja kwa nguvu (kimsingi kukadiria kwa kasi kubwa). Kwa kutumia orodha kama hizo, muda wa kuvunja nywila hupunguzwa sana isipokuwa sheria za ziada za utata wa nywila (kama vile kutoruhusu matumizi ya maneno ya kamusi) zinatekelezwa kwa ukali. Bila shaka sheria za utata wa nenosiri hazizuii watumiaji kuandika nenosiri zao, ambazo hatimaye zinaweza kupatikana kupitia "kuogelea kwenye takasusi" ikiwa na wakati karatasi iliyo na nenosiri zao inakwenda kwenye chombo cha taka.