There’s a Microsoft TechNet article called ‘Ten Immutable Laws Of Security’. It discusses ten security problems that the Microsoft Security Center feel cannot be ‘fixed’ by software. These are persistent problems that won’t be solved by an update from the software manufacturer but by following best practice and using good judgement. The ten laws are as follows:
Law #1: If a bad guy can persuade you to run his program on your computer, it’s not solely your computer anymore.
Law #2: If a bad guy can alter the operating system on your computer, it’s not your computer anymore.
Law #3: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore.
Law #4: If you allow a bad guy to run active content in your website, it’s not your website any more.
Law #5: Weak passwords trump strong security.
Law #6: A computer is only as secure as the administrator is trustworthy.
Law #7: Encrypted data is only as secure as its decryption key.
Law #8: An out-of-date antimalware scanner is only marginally better than no scanner at all.
Law #9: Absolute anonymity isn’t practically achievable, online or offline.
Law #10: Technology is not a panacea.
While the entire article is interesting and raises several very good points today we’d like to focus on Law #5 – Weak passwords trump strong security.
Passwords can be and frequently are a pain in the neck but they are a necessary evil. Currently they are simply the best way to verify the person accessing the computer/program is who they say they are.
That isn’t to suggest that they are the only way. Several other methods have been tried; facial recognition, finger print scanners and RSA Keys are just a few such methods. They all have their strengths and weaknesses but for the most part where they fail when compared to passwords is ease and convenience of use.
The problem with this is ease and convenience are the downfall of secure passwords. A short, simple and easy to remember password won’t stand up against an attempt to crack it for long. For a password to be secure it needs to complex and not easy to guess, and as such the securest passwords are generally randomly generated strings of letters, numbers and symbols, the longer the string the better.
But the average person will struggle to recall a 64 character string of characters that means nothing to them, so instead they trade off better security in favour of convenience. A quick read through lists of the most popular passwords reveals that many people will chose overly simple or easy to guess passwords such as ‘123456’ or simply ‘password’.
Somehow a compromise must be made. Passwords should be as long and as complicated as possible, while still being memorable. One suggestion we at Glo Networks can offer is, rather than just a word, why not use a phrase for your password? Switch some letters for numbers/symbols and make sure it’s a phrase that will stick with you whilst not being obvious.
Here’s a quick example of how you could change a phrase to a decent passphrase:
‘spend a penny’ becomes ‘Spend4penEE’
Using this method it becomes much easier to create a longer password that you will quickly remember every time!
Posted by James in Desktops and Laptops, General, Networking, Servers | No Comments »
After being unveiled to the public some 9 months ago Apple’s new operating system sees its release today. So congratulations expectant Apple fans: It’s a Lion! Or OSX Lion to be more precise.
When you’re looking for help with an IT problem a simple screen shot can be a powerful ally. Most Windows users are aware of the Print Screen key and its function (to capture what is displayed on the screen/s and copy it to the clipboard). A small drawback to taking a screen shot this way is the necessity to paste the captured image from the clipboard into another program in order to save it.
.
