Concept - Password Vulnerabilities and Countermeasures
Password authentication: the user gives name/login and password, the system compares it with the saved one; it also determines privileges and is used in discretionary access control (s.6).
| Attack | Idea | Countermeasure |
|---|---|---|
| Offline dictionary | get the password file, compare its hashes with hashes of common passwords (s.8) | block access to the file, IDS, rapid reissue of passwords (s.8) |
| Specific account | guess passwords for one account, e.g. user john (s.7, 9) | account lockout after failed attempts (s.9) |
| Popular password | one common password tried against many IDs (s.9) | policies against common passwords, scan IP addresses of requests (s.9) |
| Single-user guessing | use knowledge about the person and the policy (s.10) | password policy: minimum length, character set, change interval (s.10) |
| Electronic monitoring | eavesdrop a password sent over a network (s.10) | strong encryption (s.10) |
Overall list (s.11): stop unauthorized access to the file, intrusion detection, account lockout, policies against common passwords, training and enforcement, encrypted network links.
Exam tip: be ready to match an attack name to its countermeasure.
Related: Concept - Password Cracking, Concept - Password File Access Control, Concept - Better Passwords, Concept - Discretionary Access Control. Appears in 03 User Authentication - Chunk 01 (s.1-33).