Computer Internet network security News

It is better to keep a short pencil rather keeping a long memory. This quotation is by Shakespear. During Shakespear time there was no computer so no need to use passwords in applications. Now the scenario is different, one have to remember lot of passwords but one does not have to be a memory world champion such as Cornelia Beddies, in order to be able to note passwords. The memorizing password looks an art in these days.

Always use the password which are easy to remember for you and difficult to hack you. The examples may include your mother maiden name and the year of your birth, this would be a good alpha numeric combination and difficult for some one to clue. There may be other combinations too like first school attended and your phone no. etc etc

The password should not be that small in length to be easily guess or hacked by others while it should not be too long  in order to save your time and not burden your memory cells too. I think keeping moderate length of password is enough in order to keep you safe online. One more thing to consider is using the different passwords for your different sites or accounts. Suppose you are using only one password with your email account and bank account and the password has been hacked or cracked, which means the two accounts can be hacked with one time and if the same password is in being used in different accounts then the whole of your accounts are in the hands of hackers. So it is important for you to make few passwords and memorise them in order to use in your different accounts. These passwords can be alter and use reciprocally in different accounts in future.

Passwords alpha numeric, hackers, Passwords

• your name,
• anyone’s first name (especially bad are your spouse’s first name, your child’s first name, your dog’s or cat’s name)
• your nickname (e.g., “Flash” or “Buzz”),
• your home telephone number,
• your date of birth,
• your astrological sign,
• your mother’s maiden name,
• your wife’s maiden name,
• license plate number of your car,
• exact sequences of letters on a keyboard (e.g., QWERTY or ASDFGH)
• sequences from the alphabet (e.g., ABCDEFG or ABCABC)
• or any other publicly available information.

Computer security Systems, Passwords Computer security Systems, Computer-security, cyber-security, Passwords, using-passwords

Assume that institutions simply maintained databases of (pseudonymous or identified) user ids and passwords. Note carefully that the idea here is that a member of the institutional user community has a single userid and password for access to all licensed resources, and not a separate userid and password for each licensed resource.

Using SSL-encrypted forms (which eliminates the problems of transmitting passwords in the clear), it would be fairly easily for a resource to ask for this userid and password securely; one could then have a special purpose protocol so that a resource could securely check whether the userid and password were valid by querying an institutional userid/password database server. Note that SSL can set up an encrypted connection with a server certificate but no client-side certificate.

The special purpose userid/password checking protocol doesn’t exist today, but is not hard to design or implement, and since it only needs to be implemented by the resource operator and by an institutional server or two at each licensee institution, it might be much less problematic than making all licensee community users go through the complications of obtaining and installing certificates on their machines. Further, similar protocols for userid/password checking are already in use for validating users to terminal servers (i.e. TACACS, RADIUS); these might be used, or at least adapted.

Users are already familiar with user ids and passwords, including the need to keep passwords secure, to change them, and to pick them well (or at least they are more familiar with these issues than, for example, certificate use). Userids and passwords can be carried in the minds of people rather than being installed on specific machines the way that certificates are; this helps with kiosks, computer labs, libraries and other shared machine settings — assuming that one can teach the user to log off when he or she is finished, rather than just leaving the machine signed on. Probably the biggest problem with this approach — which is not shared with certificates — is that the resource operator obtains a set of globally valid credentials for the user, and has to be trusted to keep them secure. There are also some secondary problems — Trojan horse resources that capture user ids and passwords under false pretenses, for example, are a much more serious threat than they are in a certificate exchange environment.

Let’s consider passwords and user ids carried over SSL encryption from the perspective of our requirements definition. It’s clear that they are feasible and deployable. Assuming that a protocol for verifying user ids and passwords with an institutional server is standardized and deployed, the amount of work faced either by a licensee institution or a resource operator is quite manageable. Special desktop software is not required for web access; for other protocols, such as Telnet, an SSL- capable Telnet is needed (my understanding is that some of these are under development). Z39.50 credentials are a particular problem because no Z39.50 interface to a service like SSL is currently defined. User ids and passwords are clearly linked to people rather than network addresses of machines. One problem with userids and passwords is that they don’t encourage seamless navigation among resources; each resource is going to explicitly annoy the user by asking for his or her userid and password on each visit.

While passwords represent relatively weak security, a system can be put in place to require them to be difficult to guess (by forcing the use of pass phrases rather than passwords, or avoiding use of words in a dictionary), and also insisting that they be changed frequently. The use of an SSL based transport removes the security problems of transmitting them in the clear. The protection provided by SSL will depend on whether US-only (long key) or international (short key) versions of SSL are supported by the user’s browser. Userids and passwords are subject to systemic compromise from two perspectives; if the institutional password verification server is compromised, new passwords would have to be issued to all members of the user community. Also, each resource operator now shares in the responsibility for keeping userids and passwords secure; if any resource operator’s site is retaining user ids and passwords, and is compromised, this will compromise all other resource operators as well as the home institution (if the institution is using the same userid and password for internal and external authentication and authorization purposes).

Granularity and extensibility. An institutional password server will just verify that a particular userid/password combination is valid (it would also know what resource operator was asking). In situations where an access management decision needs to be made that goes beyond validity of the userid/password pair, the key question is the locus of that decision. The resource operator will either have to maintain a list of valid Ids (identities) or the password server will have to keep information about what resources a userid has access to. Or the institution would have to offer resource operators access to a user attribute database keyed on userid.

Cross-protocol flexibility: because passwords operate at a higher level of abstraction than protocols they are general. Telnet and Z39.50 support should be straightforward, assuming that there is encryption on the link over which the passwords are transmitted, as discussed above.

Privacy and accountability. The use of user ids and passwords transfers personal information directly to the resource operator. This information may be pseudononymous or identified; it will not be anonymous. To this extent, it undermines privacy but offers accountability. Management data faceted by demographic categories will be available from the resource operator only to the extent that the licensee institution provides demographic data as a byproduct of userid/password validation. there is no opportunity for the licensee institution to collect statistical information directly, other than a count of how often userid/password pairs are validated by the various resource operators.

Summary: to the extent that an institutional password verification server controls the export of individual and demographic information, passwords could work surprisingly well in an SSL-protected context. A primary benefit is that users are familiar with the model. There are important missing pieces here, particularly the protocol to permit resource operators to verify userid/password pairs with institutions that issued them. Probably the greatest weakness of this approach is the dependency on each resource operator to protect userid/password pairs, and the danger of systemic compromise due to a security failure on the part of a single resource operator.

Further comments. Clearly, by issuing different passwords and userids for different resources, it is possible to reduce the interdependence among resource operators and the dependence on each resource operator in maintaining security. However, large numbers of passwords and userids are extremely unfriendly and confusing for users, and probably impractical. For users who only use a single machine (or who are willing to store a cookie file in a network file system), and for resources that don’t require high security, it’s certainly possible to store userids and passwords as cookies on the user’s machine (though many users have become "cookie-phobic" due to the overly dire publicity surrounding cookies); once stored, the user doesn’t have to enter them at all, improving seamless cross-resource navigation. This is the approach that is taken by many low-security commercial services in the consumer marketplace today.

Passwords Password-management, Passwords

Today we talk about crating a friendly and safe One of the problems with passwords is that users forget them. In an effort to not forget them, they use simple things like their dog’s name, their son’s first name and birthdate, the name of the current month- anything that will give them a clue to remember what their password is.

For the curious hacker who has somehow gained access to your computer system this is the equivalent of locking your door and leaving the key under the doormat. Without even resorting to any specialized tools a hacker can discover your basic personal information- name, children’s names, birthdates, pets names, etc. and try all of those out as potential passwords.

To create a secure password that is easy for you to remember, follow these simple steps:

1. Never use personal information.

You should never use personal information as a part of your password. It is very easy for someone to guess things like your last name, pet’s name, child’s birth date and other similar details.

For example, rather than just having a password like ‘yr$1Hes’, you could take a sentence such as “I like to read the About.com Internet / Network Security web site” and convert it to a password like ‘il2rtA!nsws”. By substituting the number ‘2′ for the word ‘to’ and using an exclamation point in place of the ‘i’ for ‘Internet’, you can use a variety of character types and create a secure password that is hard to crack, but much easier for you to remember.

Using the tips above will help you create passwords that are more secure, but you should still also follow the following tips:

• Use different passwords. You should usea different username and password for each login or application you are trying to protect. That way if one gets compromised the others are still safe. Another approach which is less secure, but provides a fair tradeoff between security and convenience, is to use one username and password for sites and applications that don’t need the extra security, but use unique usernames and more secure passwords on sites such as your bank or credit card companies.
• Change your passwords every month. You should change your password at least every 30 to 60 days. You should also not re-use a password for at least a year.
• Enforce stronger passwords: Rather than relying on every user of the computer to understand and follow the instructions above, you can configure Microsot Windows password policies so that Windows will not accept passwords that don’t meet the minimum requirements.

Passwords Passwords

To access an online computer service or Internet service provider (ISP) one needs both a user name and password. ISPs typically select a user name that is the same as the last name of the subscriber. This means that user names are easy to guess, therefore one must be especially careful with the password.

Select a good password:
Make the length of your password at least five characters. It is too easy for automatic programs to sequentially try all combinations of characters in a password of only 1, 2, 3, or 4 characters.

In short passwords, use at least one upper-case letter, at least one lower-case letter, and at least one digit, for example, c5U3rN
A five-character password composed of only random lower-case letters has about 8×106 possible combinations, but a five-character password composed of both upper- and lower-case letters and the ten digits, all chosen randomly, has about 776×106 possible combinations, i.e., about one hundred times harder to guess.

To make a long password, use a concatenation of two words, each with at least five characters, perhaps separated by one digit (e.g., airplane5style). By having a longer password, it is no longer as desirable to include a mix of upper- and lower-case letters and digits.

Avoid obvious passwords e.g.,
your name,
anyone’s first name (especially bad are your spouse’s first name, your child’s first name, your dog’s or cat’s name)
your nickname (e.g., “Flash” or “Buzz”),
your home telephone number,
your date of birth,
your astrological sign,
your mother’s maiden name,
your wife’s maiden name,
license plate number of your car,
exact sequences of letters on a keyboard (e.g., QWERTY or ASDFGH)
sequences from the alphabet (e.g., ABCDEFG or ABCABC)
or any other publicly available information.
Also avoid any of the above spelled backwards, and any of the above either preceded or followed by a single digit.

There are about 8×106 possible combinations of a string of five lower-case letters that are chosen randomly. In comparison, there are only about 0.15×106 entries in an English dictionary for college students’ desks. Therefore, it would make sense for a hacker to use a word list from a spelling checker, instead of generating permutations of characters. In response, you should make the hacker work harder by choosing a password that is not in the dictionary of your local language.

For a given number of characters, the strongest password is a random sequence of lower- and upper-case letters and digits. However, such a password can be difficult to remember. My suggestion is to choose a unusual foreign word that does not appear in the dictionary of your local language. If you are tempted to use foreign characters (e.g., ö, é) in the password on a computer in the USA, first ask the system operator if those characters are allowed in a valid password on the system, as most operating systems in the USA are limited to using only the first 128 characters in the ASCII set (i.e., no foreign characters).

Of course, you don’t need to limit yourself to official languages. You can invent your own words, e.g., garkle6snerkle. Such words are much easier to remember than unpronounceable clusters of characters, e.g., c5U3rN.

Having chosen a good password, do not write it down, and do not tell anyone what it is. (Get a separate account for your spouse, each of your children, each of your co-workers, …. so that no one shares passwords.) This rule can create a problem if you die or are incapacitated, so perhaps you should write it down once: on a sheet of paper that you keep in a bank’s safe deposit box (for your personal account) or in a safe in the corporate office (for the company’s computer).

When you get a new computer account, it will come with an initial password, which password was probably randomly chosen. Follow the instructions from the system administrator for choosing your own password, and change the password. The initial password may have been seen by someone who gave or mailed it to you.

Use a different password at each website, service provider, or computer account.

Changing your password every few weeks is standard advice from computer security experts. However, changing your password every few weeks also makes it easier for you to forget your password. You need to decide if it is worth the bother of changing passwords every few weeks. If you do forget your password, you will need to contact a system administrator, prove that you really are the official user, and get a new initial password assigned.

Many users store their user name and password in a logon script on their hard disk in various programs: e-mail (e.g., Eudora), webbrowser (e.g., Netscape), terminal emulator (e.g., Procomm), and modem control programs (e.g., Trumpet Winsock). This storage of user name and password is convenient, as it automates the logon process. However, if you store your user name and passwords in logon script(s), then:
You should definitely enable the password setting in the BIOS of your computer, so that a password is required everytime the machine is switched on. You might also enable a password setting in Windows98 or other operating system, to give an additional layer of protection against unauthorized use of your computer.

If other people have access to your computer when your machine is running and you are away from your desk, you should install screen saver software that requires a password to return to the operating system or applications software.

If your computer is stolen, it is possible for the thief to logon to all of your accounts. Therefore, it is essential that you logon to each of your online accounts and change the password for each account immediately after the theft of the computer is discovered.

This remediation includes changing your passwords at online stores (e.g., amazon.com). The information stored on your computer in the cookies.txt file that your webbrowser accesses identifies you to each online store, and could make it possible for a thief to impersonate you and to charge items to your credit card.

Nearly everyone has private data (e.g., medical and financial data on a home computer; business secrets on a computer in the office) on their machine. The same suggestions about a password in BIOS and a password in a screen saver apply if you have confidential or proprietary information on your computer. However, unlike changing online account passwords, there is no easy way to destroy the value of confidential data in files on a stolen computer. Users with very sensitive data (e.g., military secrets, major trade secrets) should encrypt all of their data files.

Passwords Password-management, Passwords

VeriSign has already teamed up with PayPal to offer one-time use passwords on key fobs, but it looks like it’s now found a way to make that additional layer of protection even more portable, partnering with Innovative Card Technologies Inc. to squeeze the disposable digits onto standard size bank cards. Apparently, you’ll get a new password after each transaction you make online (displayed by pushing a button on the back of the card), making it theoretically impossible for anyone without the card to access your account, even if they somehow manage to get a hold of your regular password. While it’s not clear when the cards will actually be put into use, VeriSign is promising to make an announcement about a “major bank” set to use the cards sometime this month.

Passwords bank cards, paypal, verisign

IDC research finds that enterprise companies rank insider sources as their top security threat.

In addition, research from Carnegie Mellon University for the Department of Defense (DoD) finds that when it comes to insider attacks, 86 percent of perpetrators held technical positions. Of these, 57 percent performed the attack after termination.

Both reports found that insider attacks result in costly outages, lost business, legal liability and, inevitably, failed audits. In one case study, it took 115 employees 1,800 hours to restore data deleted by a disgruntled insider. At the time of the attack, the perpetrator was an ex-employee of the IT department who was able to remotely access key systems. According to these reports, IT insiders commonly acquire and maintain powerful system access using privileged accounts and passwords even after termination.

Here are six of the best practices recommended by Calum MacLeod (European director, Cyber-Ark Software) to battle insider menace:

1: Create an inventory of privileged (non-personal) passwords

2: Define the role of identity and access management (IAM)

3: Apply change policies to privileged passwords

4. Make sure privileged passwords are stored securely

5. Create a staged approach to deployment

6: Remember computers are people, too

See full story.

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.

Passwords Password-management

IDC research finds that enterprise companies rank insider sources as their top security threat.
In addition, research from Carnegie Mellon University for the Department of Defense (DoD) finds that when it comes to insider attacks, 86 percent of perpetrators held technical positions. Of these, 57 percent performed the attack after termination.
Both reports found that insider attacks result in costly outages, lost business, legal liability and, inevitably, failed audits. In one case study, it took 115 employees 1,800 hours to restore data deleted by a disgruntled insider. At the time of the attack, the perpetrator was an ex-employee of the IT department who was able to remotely access key systems. According to these reports, IT insiders commonly acquire and maintain powerful system access using privileged accounts and passwords even after termination.
Here are six of the best practices recommended by Calum MacLeod (European director, Cyber-Ark Software) to battle insider menace:
1: Create an inventory [...]

Original post by Administrator and software by Elliott

Passwords Password-management

Here are a few simple reminders to help prevent crooks and identity thieves from stealing your holiday spirit:

- Don’t carry your Social Security card with you: Identity thieves can use it to set up new accounts at different addresses without your approval, or your knowledge.

- Take care to remove your bank deposit slips from your purse or wallet as soon as you return home – they often contain important personal information that needs to be closely guarded.

- Carry only one (or at the most two) credit cards with you when you’re out shopping.

- Write the words “see picture ID” on all of your credit cards. While many clerks are trained to check photo identification, it doesn’t hurt to remind them.

- Guard against “shoulder surfers” – thieves hovering around you at the ATM or check-out scanner.

- Carefully shred your bank and credit card statements.

See full story.

We also recommend you to safeguard all sensitive information stored on your PC or PDA. Sensitive data stored on your computer should be protected with specific software tools and kept in a “safe place” on your hard drive or removable devices.

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.

Passwords Password-management

Here are a few simple reminders to help prevent crooks and identity thieves from stealing your holiday spirit:
- Don’t carry your Social Security card with you: Identity thieves can use it to set up new accounts at different addresses without your approval, or your knowledge.
- Take care to remove your bank deposit slips from your purse or wallet as soon as you return home – they often contain important personal information that needs to be closely guarded.
- Carry only one (or at the most two) credit cards with you when you’re out shopping.
- Write the words “see picture ID” on all of your credit cards. While many clerks are trained to check photo identification, it doesn’t hurt to remind them.
- Guard against “shoulder surfers” – thieves hovering around you at the ATM or check-out scanner.
- Carefully shred your bank and credit card statements.
See full story.
We also recommend you to safeguard [...]

Original post by Administrator and a wordpress plugin by Elliott

Passwords Password-management

SecurityFocus has a great article on Windows password security. Among other things, it addresses the real implications of the weaknesses of LanMan and NTLMv2, and a way you can use that to your advantage:
if a password is fifteen characters or longer, Windows does not even store the LanMan hash correctly. This actually protects you from brute-force attacks against the weak algorithm used in those hashes. If your password is 15 characters or longer, Windows stores the constant AAD3B435B51404EEAAD3B435B51404EE as your LM hash, which is equivalent to a null password.

And I remember creating my fist Alt+255 password years ago. It was a pain to enter, and the author makes a good point:
It common to see recommendations to use high-ASCII characters as the ultimate password tip. High-ASCII characters are those that cannot normally be typed on a keyboard but are entered by holding down the ALT key and typing the [...]

Original post by Security Wonk and powered by Img Fly

Passwords, Windows security ascii_characters, Authentication, Passwords, password_security, ultimate_password, Windows security, Windows-security, windows_password

Counter to what the movies might say, hacking grades is not just cheating it’s a crime:

An investigation showed the professor’s network account had been accessed without her permission and grades were assigned to nearly 300 students, prosecutor Robert Fratianne said.

I bet they just guessed her password but still, there’s more legal ways to cheat.
Students face 1 year in jail for hacking [Yahoo News / AP]

Read more at  Security Wonk 

Computer threats, Government IT security, Passwords Authentication, Computer threats, computer-threats, Government IT security, Government-IT-security, Identity-theft, Passwords