Re: The myths of SBS

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Wesley Kendall [MSFT] (a-wesk_at_online.microsoft.com)
Date: 05/28/04 

Date: Fri, 28 May 2004 02:20:15 GMT

>So you have had some experience with strong passwords and their complete
>failure short of a gadget. The presence of the sticky notes is of course
>just a SYMPTOM of the failure of IT to SIMPLIFY their computer experience.
>Generally an easily remembered weak password is MORE secure on the average
>over smaller installations than strong passwords which are most always
>FINDABLE.
>
>Weak easily remembered fixed passwords or gadgets are the reasonable
>solution in an environment where the consultant/expert is trying to help
and
>simplify the computer experience for that average non-expert. Trying to
>tell folks that they should remember a random string of >= 10 chars and
your
>gonna change it every 60 days is the same as telling those folks to find
>another consultant/expert; they're gonna catch-on to that before long.

There are several ways to create easily-remembered strong passwords. One is
using the passphrase approach. You can take a simple password like your
dog's name, "lucky" and create an easily-remembered passphrase, "My dog
Lucky!". Spaces are legitimate in Windows passwords. That easily-remembered
passphrase is a complex, 13-character password that includes a special
character and a combination of uppercase and lowercase letters.

The password policy around here is almost rediculous, yet none of us
complain. We understand the need for security.

Weak passwords are the cause of many hacks and open mail relays. I get at
least one call a week where someone's username/password combination has
been compromised and the mail server is sending out mail because a spammer
can authenticate against the mail server with the stolen credentials.

The bottom line is that a compromised account is an open door. If you can
justify the cost of implementing smart cards, biometrics, or some other
technically advanced way of securing the network, go for it. People with
budgets have to rely on strong passwords as the base defense. 

--
Wesley Kendall
Small Business Server Product Support
This posting is provided "AS IS" with no warranties, and confers no rights.
Get Secure! http://www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================

Relevant Pages

  • Re: Mail program is malfunctioning
    ... any problem it has talking to your mail server. ... The chance that it's forgotten folks passwords is rather ...
    (comp.sys.mac.apps)
  • Re: What is the likelihood of password sniffing ?
    ... - there are logs kept on the mail server as to which ip address accessed ... passwords & usr names MUST be sent ... > I would guess at ISPs first, or maybe someone's PC that has been ... > where I have to receive un-encrypted financial information, ...
    (alt.computer.security)
  • Re: The myths of SBS
    ... >>failure short of a gadget. ... >>just a SYMPTOM of the failure of IT to SIMPLIFY their computer experience. ... >>over smaller installations than strong passwords which are most always ... > can authenticate against the mail server with the stolen credentials. ...
    (microsoft.public.windows.server.sbs)
  • password file recovery question
    ... I've had to rebuild a mail server from scratch, ... passwords are scrambled for most users. ... I did notice that if I already have passwords set before I copy the ...
    (freebsd-stable)
  • Re: The myths of SBS
    ... Once we get them used to basic strong passwords, ... How are you Root! ... their computer experience. ... The only question left is which one of the gadgets is the right ...
    (microsoft.public.windows.server.sbs)