Understanding Security Policies Module 3 Understanding Security Policies Christopher Chapman | Content PM , Microsoft Thomas Willingham | Content Developer, Microsoft

Module Overview Common Password Attacks Password Policies

Common Password Attacks

Dictionary and Brute Force Attacks A dictionary attack uses a dictionary containing an extensive list of potential passwords that the attacker then tries in conjunction with a user ID in an attempt to guess the appropriate password. Another, more crude type of attack—called a brute force attack— doesn’t rely on lists of passwords, but rather tries all possible combinations of permitted character types.

Physical Attacks Anytime your computer can be physically accessed by an attacker, that computer is at risk. Physical attacks on your computer can completely bypass almost all security mechanisms, such as by capturing the passwords and other critical data directly from the keyboard when a software or hardware keylogger is used. In fact, if your encryption key passes through a keylogger, you might find that even your encrypted data is jeopardized.

Network Sniffers Sniffers are specially designed software (and in some cases hardware) applications that capture network packets as they traverse a network, displaying them for the attacker. Sniffers are valid forms of test equipment, used to identify network and application issues, but the technology has been rapidly co-opted by attackers as an easy way to grab logon credentials.

Password Policies

Password Complexity Password complexity involves the characters used to make up a password. A complex password uses characters from at least three of the following categories: English uppercase characters (A through Z) English lowercase characters (a through z) Numeric characters (0 through 9) Non-alphanumeric characters (!, @, #, $, %, ^, &, etc.)

Password Length, Age, and History Password length is the number of characters used in a password. Time between password changes can be defined by two settings: Minimum Password Age Maximum Password Age Password history prevents users from recycling the same passwords through a system.

View and Create a Password Policy Demo 1 – Create a password policy on the domain controller and assign password complexity, length, age, and history 2 –Try to change the password for a user to test the policy View and Create a Password Policy

Account Lockout Account lockout settings allow you to specify when to lock an account if incorrect logon attempts happen. Microsoft provides three separate settings with respect to account lockout: Account lockout duration Account lockout threshold Reset account lockout counter after

View and Create Account Lockout Policy Demo 1 – Create an account lockput policy 2 – Test it by locking an account by typing the password incorrectly View and Create Account Lockout Policy

Additional Resources & Next Steps Books Exam 98-367 Security Fundamentals Exam 98-366: MTA Networking Fundamentals Exam Ref 70-410: Installing and Configuring Windows Server 2012 Instructor-Led Courses 40349A: Windows Operating System Fundamentals: MTA Exam 98-349 40366A: Networking Fundamentals: MTA Exam 98-366 40365A: Windows Server Administration Fundamentals: MTA Exam 98-365 20410C: Installing and Configuring Windows Server 2012 Exams & Certifications Exam 98-367: Security Fundamentals Exam 98-349: Windows Operating System Fundamentals Exam 98-366: Networking Fundamentals Exam 98-365: Windows Server Administration Fundamentals Exam 70-410: Installing and Configuring Windows Server 2012