2KKUU7ita

114
Part II: Putting Ethical Hacking in Motion
Countermeasures
The best defenses against attacks on passwords in limbo are solid help desk
policies and procedures that prevent weak passwords from being available
at any given time during the new account generation and password reset processes.
Perhaps the best ways to overcome this vulnerability are as follows:
✓ Require users to be on the phone with the help desk, or have a help
desk member perform the reset at the user’s desk.
✓ Require that the user immediately log in and change the password.
✓ If you need the ultimate in security, implement stronger authentication
methods, such as challenge/response questions, smart cards, or digital
certificates.
✓ Automate password reset functionality via self-service tools on your
network so users can manage most of their password problems without
help from others.
I cover mobile-related password cracking in Chapter 10 and website/application
password cracking in Chapter 14.
General Password-Cracking
Countermeasures
A password for one system usually equals passwords for many other systems
because many people use the same (or at least similar) passwords on every
system they use. For this reason, you might want to consider instructing
users to create different passwords for different systems, especially on the
systems that protect information that’s more sensitive. The only downside to
this is that users have to keep multiple passwords and, therefore, might be
tempted to write them down, which can negate any benefits.
Strong passwords are important, but you need to balance security and
convenience:
✓ You can’t expect users to memorize passwords that are insanely complex
and must be changed every few weeks.
✓ You can’t afford weak passwords or no passwords at all, so come up
with a strong password policy and accompanying standard — preferably
one that requires long and strong passphrases (combinations of words
that are easily remembered yet next to impossible to crack) that have to
be changed only once or twice a year.