Educause Security Discussion mailing list archives
Re: Password Expiration
From: Harold Winshel <winshel () CAMDEN RUTGERS EDU>
Date: Tue, 11 Apr 2006 07:10:23 -0400
Gene, Wow - thanks for the very detailed explanation. And I wasn't aware of a lot of the background information on where the password-changing policy had come from I also tend to lean against forcing the regular password changes. To me, unless you have a very controlled environment, which universities typically are not, some users will behave in ways that undermine - sorry, I mean actually make it worse - the situation. To me it seems an issue of knowing not only how the machines work but how the people work. Thanks again! Harold At 10:25 PM 4/10/2006, you wrote:
I have found this discussion quite interesting, especially as our campus has recently adopted a brain-dead password change policy. From a high-level perspective, let me observe that one problem with any widespread change policy is that it fails to take into account the various threats and other defenses that may be in place. Policies should always be based on a sound understanding of risks, vulnerabilities, and defenses. "Best practice" is intended as a default policy for those who don't have the necessary data or training to do a reasonable risk assessment. Consider the underlying role of passwords: authentication. Good authentication is intended to support access control, accountability and (in some cases) accounting. Passwords provide a cost-effective and user-familiar form of authentication. However, they have a number of failure modes depending on where they are used and the threats arrayed against them. Failure modes include disclosure, inference, exposure, loss, guessing, cracking, and snooping. In the most general case, passwords (such as the security numbers on credit cards, or mother's maiden name) are not sufficiently secret and are simply too weak to use as strong authenticators. I'll skip this case. Disclosure is a systemic threat on the platforms involved, as well as the operational methods used to generate and transmit the passwords. This cannot be addressed through changing the password. Instead, the methods used to generate and distribute passwords needs to be examined to ensure that the passwords are not disclosed to the wrong parties. Most operating systems are currently designed so that passwords are not stored "in the clear" and this reduces the chance of disclosure. Unfortunately, some 3rd-party applications (including web-based systems) fail to adequately guard the passwords as they are entered, stored, or compared, resulting in potential disclosure. Another form of disclosure is when the holder of the password discloses the password on purpose. This is an education and enforcement issue. (Anecdote: at one location where a new policy was announced that passwords must be changed every month, a senior administrator was heard to moan "Do you know how much time I'm going to waste each month ensuring that everyone on my staff knows my new password?") Inference occurs when there is a pattern to the way the passwords are generated/chosen and thus can be inferred. For instance, knowing that someone uses the same password with a different last character for each machine allows passwords to be inferred, especially if coupled with disclosure of one. Exposure is the case where accident or unintended behavior results in a sporadic release of a password. As an example, think of someone accidentally typing her password as the user name in login, and it is captured in the audit trail. Or someone accidentally types his password during a demonstration and it is exposed on a projection screen. Loss is when someone forgets his or her password, or (otherwise) loses whatever is used to remind/recreate the password. Guessing is self-explanatory. Guessing is limited to choices that can be guessed. After a certain limited number of choices, the guessing can only transform into a cracking attempt. Cracking is when an intermediate form of the password (e.g., an encrypted form stored in the authentication database) is captured and attacked algorithmically, or where iterated attempts are made to generate the password algorithmically. The efficacy of this approach is determined by the strength of the obfuscation used (e.g., encryption), the checks on bad attempts, and the power and scope of the resources brought to bear (e.g., parallel computing, multi- lingual databases). Snooping (eavesdropping) is when someone intercepts a communication employing the password, either in cleartext or in some intermediate form. The password is then extracted. Network sniffing and keyloggers are both forms of snooping. Various technical measures, such as network encryption, can help reduce the threat. Now, looking back over those, periodic password changing really only reduces the threats posed by guessing, and by weak cracking attempts. If any of the other attack methods succeed, the password needs to be changed immediately to be protected -- a periodic change is likely to be too late to effectively protect the target system. Furthermore, the other attacks are not really blunted by periodic password changes. Guessing can be countered by enforcing good password selection, but this then increases the likelihood of loss by users forgetting the passwords. The only remaining threat is that periodic changes can negate cracking attempts, on average. However, that assumes that the passwords choices are appropriately random, the algorithms used to obfuscate them (e.g., encryption) are appropriately strong, and that the attackers do not have adequate computing/algorithmic resources to break the passwords during the period of use. This is NOT a sound assumption given the availability of large-scale bot nets, vector computers, grid computing, and so on -- at least over any reasonable period of time. In summary, forcing periodic password changes given today's resources does not significantly reduce the overall threat -- unless the password is immediately changed after each use. This is precisely the nature of one-time passwords or tokens. So where did the "change passwords once a month" dictum come from? Back in the days when people were using mainframes without networking, the biggest uncontrolled concern was cracking. Resources, however, were limited. As best as I can find, some DoD contractors did some back-of-the-envelope calculation about how long it would take to run through all the possible passwords using their mainframe, and the result was several months. So, they (somewhat reasonably) set a password change period of 1 month as a reasonable means to defeat systematic cracking attempts. This was then enshrined in policy, which got published, and largely accepted by others over the years. As time went on, auditors began to look for this and ended up building it into their "best practice" that they expected. It also got written into several lists of security recommendations. This is DESPITE the fact that any reasonable analysis shows that a monthly password change has little or no end impact on improving security! It is a "best practice" based on experience 30 years ago with non-networked mainframes in a DoD environment -- hardly a match for today's systems, especially in academia! The best approach is to determine where the threats are, and choose defenses accordingly. Most important is to realize that all systems are not the same! Some systems with very sensitive data should probably be protected with two-factor authentication: tokens and/or biometrics. Other systems/accounts, with low value, can still be protected by plain passwords with a flexible period for change. Of course, that assumes that the OS is strong enough to protect against overall compromise once a low-privilege account is compromised....not always a good bet in today's operating environment! And, btw, I've got some accounts where I've used the same password for several years with nary an incident. But in the spirit of good practice, that's all I'm going to say about the passwords, the accounts, or how I know they are still safe. :-)
Harold Winshel Computing and Instructional Technologies Faculty of Arts & Sciences Rutgers University, Camden Campus 311 N. 5th Street, Room B36 Armitage Hall Camden NJ 08102 (856) 225-6669 (O)
Current thread:
- Password Expiration Nancy R Evans (Apr 07)
- <Possible follow-ups>
- Re: Password Expiration David Walker (Apr 07)
- Re: Password Expiration Harold Winshel (Apr 07)
- Re: Password Expiration Dave Koontz (Apr 08)
- Re: Password Expiration Charlie Prothero (Apr 09)
- Re: Password Expiration Harold Winshel (Apr 09)
- Re: Password Expiration Harold Winshel (Apr 10)
- Re: Password Expiration Bill Betlej (Apr 10)
- Re: Password Expiration Geoffrey S. Nathan (Apr 10)
- Re: Password Expiration Gene Spafford (Apr 10)
- Re: Password Expiration Harold Winshel (Apr 11)
- Re: Password Expiration Steve Worona (Apr 11)
- Re: Password Expiration David Walker (Apr 11)
- Re: Password Expiration Gene Spafford (Apr 11)
- Re: Password Expiration Stewart, Ian (Apr 12)