The Weakest Link Is You

Rick Borstein explains what should be obvious good password policy, but with a twist: He addresses how to protect communications sent to someone with a close associate who might be able to figure out a password.

Borstein used as an example a lawyer handling a divorce between a husband and wife living in the same household. The lawyer needed to send documents to one spouse without the other reading them. The situation presented a twofold problem: choosing a password the one spouse could remember, but the other one wouldn't figure out.

It's surprising the ease with which passwords can be got. Back in October, my 12-year-old daughter asked why she could so easily access my iTunes account and change the password if she wanted. While she was trying to play a song purchased from my account on her computer, iTunes prompted to authorize playback. The software presented a dialog box with my e-mail address as the user name and a space for password.

Alongside the blank space for the password was a button asking, "Forgot password?" By clicking on this button, my daughter ended up at a page asking for my birthday, which she knew, and the answer to a secret question. I had simply put in a single word, "Maine," instead of drafting a question. After several guesses, my daughter chose "moose," which got her into the account.

Borstein's example is a good one, because a family member would have plenty of knowledge with which to crack the password. At the same time, the password shouldn't be too difficult for the other spouse to remember.

His advice about choosing a password--never obvious stuff like names or birthdays, and never sending it by e-mail--is good, too. Passwords remain a weak link, particularly if a password is the only security mechanism.

Following Microsoft's first Windows Vista launch in November, I met with three HP executives to discuss their company's plans for the new operating system. During the conversation we discussed Windows Vista security and the broad mechanisms companies should use to secure their networks. Each person's laptop had a USB dongle attached, which acted as a secure lock. No dongle, no access. They couldn't connect to their corporate network without the USB dongle, and neither could thieves.

This week, eWEEK.com editors put together a list of five best practices for enterprise security: assessment, prevention, detection, response and vigilance. A podcast, available today, offers deeper insight into these best practices.

Security is going to be a big topic for Windows Vista and a focus for many IT organizations evaluating the operating system. But any operating system, like any network, is only as good as its weakest point: the user.

What happens when someone uses the same passwords for home and work and the personal computer is breached by a Trojan or keylogger? The person might not use the home computer to access the work network, but the single pilfered password would be useful enough. There's enough public information on the Internet to identify where someone works, assuming the hacker couldn't pluck the information from the computer or the victim's banking or investment accounts. Common conventions for e-mail or user names would make the password usable once the employer was known. Enterprises are increasingly a target of information thieves.

No matter how improved Windows Vista security is, weak IT organization security policy--or none at all--will lay the operating system open to assault. In a Monday blog, eWEEK Security Center Editor Larry Seltzer aptly discussed what to expect from Windows Vista security.

Larry wrote, "A big part of hardening a product against attack is to be prepared for when a failure occurs. This is why you keep hearing from Microsoft about 'Defense in Depth.' The idea is that a failure in one form of protection can be mitigated by other protections."

With Windows Vista, Microsoft presumes that several mechanisms are necessary to protect the operating system; the approach also seeks to protect users from their own shortcomings, like creating weak passwords. The multilevel security approach is pervasive in Vista and also Internet Explorer 7.

The safest car on the road is only as good as the driver. No airbag, seatbelt or hardened auto frame can protect the careless driver who smacks into an overpass at 130 km/hour. Likewise, Vista's Defense in Depth is only as good as the weakest link, and the weakest link is you.