Passwords are a cornerstone of computer security. Virtually every sensitive computer resource requires one or more passwords to access it in any context. Most virtual authentication methods are based on some form of password, or security token. Given that passwords are chosen by the user, who tends to pick words easily remembered, along with poor password implementation, weak passwords are a common method for network intrusion. Despite decades of reliance upon these passwords, systems still ship with no password, easily guessed passwords, or no mechanisms to force users to maintain strong passwords. This often leads to passwords that are weak and easy to compromise.

While it is an accepted fact of security that any password can be guessed given sufficient resources, every organization should attempt to maintain strong passwords to deter and delay such compromises. The following measures can be taken to help in this process:

1. Passwords should be sufficiently complex:
a. Be at least eight characters in length
b. Contain upper case, lower case, and special characters
c. Not be a word in any language or found in any dictionary
d. Not bear any resemblence to the user, family, pets, etc.
2. Enforce password history. Ensure users must pick a new unique password and can not re-use old passwords.
3. Maximum password age. After a set amount of time (recommended 30 - 90 days), the password should expire and force users to select a new one.
4. Test password security by attempting to "crack" passwords. Only do so with written permission from a CEO/CSO/CxO.
5. Ensure users are educated on password security and the importance of passwords. This includes training on what not to do regarding passwords (ie: share them, write them down).

• Microsoft Knowledge Base Article: 143474 246261
• CVE ID: 1999-0503 (see also: NVD) 1999-0504 (see also: NVD) 1999-0505 (see also: NVD) 1999-0506 (see also: NVD)
• Metasploit ID: 3106
• Generic Exploit URL: http://www.saintcorporation.com/cgi-bin/exploit_info/smb_login
• Generic Informational URL: http://www.sans.org/top20/#w3
  http://www.sans.org/top20/oct02.php#W1
• Keyword: SANS Top 20 2002 Windows Issue #07 SANS Top 20 2003 Windows Issue #03

Unknown or Incomplete