1. Understanding Security Policies
Module 3
Understanding Security Policies
Christopher Chapman | Content PM , Microsoft
Thomas Willingham | Content Developer, Microsoft

2. Module Overview
Common Password Attacks
Password Policies

3. Common Password Attacks

4. Dictionary and Brute Force Attacks
A dictionary attack uses a dictionary containing an extensive list of potential passwords that the attacker then tries in conjunction with a user ID in an attempt to guess the appropriate password.
Another, more crude type of attack—called a brute force attack— doesn’t rely on lists of passwords, but rather tries all possible combinations of permitted character types.

5. Physical Attacks
Anytime your computer can be physically accessed by an attacker, that computer is at risk.
Physical attacks on your computer can completely bypass almost all security mechanisms, such as by capturing the passwords and other critical data directly from the keyboard when a software or hardware keylogger is used.
In fact, if your encryption key passes through a keylogger, you might find that even your encrypted data is jeopardized.

6. Network Sniffers
Sniffers are specially designed software (and in some cases hardware) applications that capture network packets as they traverse a network, displaying them for the attacker.
Sniffers are valid forms of test equipment, used to identify network and application issues, but the technology has been rapidly co-opted by attackers as an easy way to grab logon credentials.

7. Password Policies

8. Password Complexity
Password complexity involves the characters used to make up a password.
A complex password uses characters from at least three of the following categories:
English uppercase characters (A through Z)
English lowercase characters (a through z)
Numeric characters (0 through 9)
Non-alphanumeric characters #, $, %, ^, &, etc.)

9. Password Length, Age, and History
Password length is the number of characters used in a password.
Time between password changes can be defined by two settings:
Minimum Password Age
Maximum Password Age
Password history prevents users from recycling the same passwords through a system.

10. View and Create a Password Policy
Demo
1 – Create a password policy on the domain controller and assign password complexity, length, age, and history
2 –Try to change the password for a user to test the policy
View and Create a Password Policy

11. Account Lockout
Account lockout settings allow you to specify when to lock an account if incorrect logon attempts happen.
Microsoft provides three separate settings with respect to account lockout:
Account lockout duration
Account lockout threshold
Reset account lockout counter after

12. View and Create Account Lockout Policy
Demo
1 – Create an account lockput policy
2 – Test it by locking an account by typing the password incorrectly
View and Create Account Lockout Policy

13. Additional Resources & Next Steps
Books
Exam Security Fundamentals
Exam : MTA Networking Fundamentals
Exam Ref : Installing and Configuring Windows Server 2012
Instructor-Led Courses
40349A: Windows Operating System Fundamentals: MTA Exam
40366A: Networking Fundamentals: MTA Exam
40365A: Windows Server Administration Fundamentals: MTA Exam
20410C: Installing and Configuring Windows Server 2012
Exams & Certifications
Exam : Security Fundamentals
Exam : Windows Operating System Fundamentals
Exam : Networking Fundamentals
Exam : Windows Server Administration Fundamentals
Exam : Installing and Configuring Windows Server 2012