Password Security Fundamentals

Password Security Fundamentals

• Password strength: A strong password should be:
  • At least 12 characters long
  • A mix of uppercase and lowercase letters
  • Include numbers and special characters
  • Not a dictionary word or common phrase
  • Not used for multiple accounts
• Password types:
  • Weak passwords: Easily guessed, common words, or simple combinations
  • Strong passwords: Complex, unique, and hard to guess
  • Passphrases: A sequence of words used as a password

Password Storage and Transmission

• Hashing: A one-way encryption process that stores passwords as a fixed-length string
  • Salt: A random value added to the password before hashing to prevent rainbow table attacks
• Password transmission: Use secure protocols like HTTPS and SSL/TLS to encrypt passwords during transmission

Password Cracking and Attacks

• Brute force attacks: Automated attempts to guess passwords using all possible combinations
• Dictionary attacks: Using a list of words to guess passwords
• Rainbow table attacks: Precomputed tables of hashes for common passwords
• Phishing attacks: Tricking users into revealing their passwords

Password Management Best Practices

• Use a password manager: Generate and store unique, complex passwords for each account
• Use two-factor authentication (2FA): Add an extra layer of security to prevent unauthorized access
• Regularly update and change passwords: To minimize the impact of a potential breach
• Avoid password reuse: Use a unique password for each account

Additional Security Measures

• Account lockout policies: Lock out users after a specified number of incorrect password attempts
• Password expiration: Force users to update their passwords at regular intervals
• Password requirements: Enforce strong password policies for users and systems