Password Security - CompTIA Security+ SY0-701 - 4.6

Summary

The video script emphasizes the importance of creating strong passwords with high entropy to prevent guessing and attacks like brute force. It suggests using a mix of upper and lower case letters, numbers, and special characters, and recommends a minimum length of eight characters. Passwords should be unique per account and changed regularly, with expirations enforced by systems. Password managers can securely store and generate these passwords, while passwordless authentication methods are gaining popularity for added security. The script also touches on just-in-time permissions for temporary administrative access, enhancing security in IT environments.

Takeaways

• 🔒 Creating a password with high entropy is crucial for security against guessing and brute force attacks.
• 🔡 A strong password should include a mix of uppercase and lowercase letters, numbers, and special characters.
• 📏 Passwords are often recommended to be at least eight characters long, with some systems requiring even longer for enhanced security.
• ⏳ Passwords have an expiration age, after which they must be changed to maintain security.
• 🔔 Users are typically notified before their password expires, prompting them to update it to maintain access.
• 🚫 Systems may prevent the reuse of old passwords to enhance security.
• 🔑 Using a different password for each account can prevent a single breach from compromising multiple accounts.
• 🗝️ Password managers can securely store multiple passwords, requiring strong access credentials to use them.
• 🛡️ Password managers often offer features to generate strong, unique passwords automatically.
• 🕊️ Some systems are moving towards passwordless authentication methods to eliminate the risks associated with password reuse.
• 🌐 In enterprise environments, just-in-time permissions can provide temporary administrative access based on security policies, reducing the risk of constant high-level access.
• 🛡️ Central clearinghouses or password vaults manage primary credentials and issue temporary, controlled access to systems.

Q & A

Why is it important to create a password that is difficult to guess?

Creating a difficult-to-guess password helps prevent attackers from using password spraying or brute force attacks, thereby increasing the security of the account.

What does entropy mean in the context of passwords?

Entropy in passwords refers to the measure of unpredictability of the password, indicating how hard it is to guess or crack.

What are the recommended components for a strong password?

A strong password should include a mix of uppercase and lowercase letters, numbers, and special characters to increase its complexity and security.

What is the minimum recommended length for a password?

The minimum recommended length for a password is at least eight characters, although requirements are increasing as systems become more efficient.

Why might systems encourage the use of a phrase for a password?

Using a phrase or set of words can result in a longer password, which tends to be more secure and easier to remember than a random string of characters.

What is the purpose of password expiration policies?

Password expiration policies are in place to force users to change their passwords periodically, reducing the risk of password reuse and increasing account security.

What is the consequence of not changing an expired password?

If a password is not changed after it expires, the user will be unable to log in to the account, as many systems enforce password changes for security reasons.

Why is it advised to use a different password for each account?

Using a different password for each account prevents an attacker from gaining access to multiple accounts if one password is compromised.

What is a password manager and how does it help with password security?

A password manager is a tool that securely stores all of a user's passwords in one encrypted database, simplifying the process of managing multiple unique passwords and enhancing security.

What is the advantage of using a password manager for generating new passwords?

Password managers can automatically generate new, random, and unique passwords for each site, reducing the risk of password reuse and making it easier for users to maintain strong security practices.

What is passwordless authentication and how does it differ from traditional password use?

Passwordless authentication is a method of logging into a system without using a password, often employing biometrics or personal identification numbers. It eliminates the risk of password reuse and the need to remember multiple passwords.

What is just-in-time permissions and how does it enhance security in IT environments?

Just-in-time permissions is a security practice where users receive temporary administrative access for a limited time using a set of temporary credentials. This reduces the risk of unauthorized access and potential breaches.

Outlines

00:00

🔐 Password Creation and Security Practices

This paragraph discusses the importance of creating strong passwords with high entropy to prevent guessing by attackers. It emphasizes the use of a mix of uppercase and lowercase letters, numbers, and special characters, and suggests a minimum length of eight characters, which is often increasing due to system capabilities. The concept of password age and expiration is introduced, with many systems prompting users to change passwords every 30 to 90 days. Password history is often tracked to prevent reuse. The best practice is to use unique passwords for each account to avoid a single breach affecting multiple accounts. The paragraph also introduces password managers as a solution for managing multiple complex passwords, detailing their encryption and multifactor authentication features. It touches on the growing trend of passwordless authentication methods, such as biometrics and personal identification numbers, which can be used in conjunction with traditional passwords for added security.

05:02

🛠️ Just-in-Time Permissions for Enhanced Security

The second paragraph delves into the concept of just-in-time (JIT) permissions, a security measure used to grant temporary administrative access to technicians for specific tasks. This approach prevents unauthorized access by limiting the duration of elevated privileges. The process involves a central clearinghouse that assesses security policies before granting access. The clearinghouse or password vault holds primary credentials and generates temporary credentials for users on an as-needed basis. These credentials are ephemeral, meaning they are deleted after use, ensuring that primary credentials remain secure. The paragraph highlights the benefits of JIT permissions in reducing the risk of a security breach by ensuring that even if an attacker compromises an account, they would not gain administrator access to systems.

Keywords

💡Password

A password is a secret word or phrase used to authenticate an individual's identity for secure access to systems or data. In the video's context, it is the fundamental concept for discussing the security of digital accounts. The script emphasizes the importance of creating passwords that are difficult to guess to prevent unauthorized access, such as through password spraying or brute force attacks.

💡Entropy

Entropy, in the context of passwords, refers to the measure of unpredictability or randomness. A password with high entropy is more secure because it is less likely to be guessed. The script mentions that a password with increased entropy is desirable, suggesting the use of a mix of uppercase and lowercase letters, numbers, and special characters.

💡Password Spraying

Password spraying is a type of cyber attack where an attacker tries multiple accounts with the same password. The script warns against this by advocating for complex passwords that are not easily guessed, thus reducing the risk of successful password spraying attacks.

💡Brute Force Attack

A brute force attack involves systematically checking all possible combinations of passwords until the correct one is found. The script discusses the importance of creating passwords that are resistant to such attacks by increasing their complexity and length.

💡Password Length

The length of a password is a critical factor in its security. The script suggests that ideally, a password should be at least eight characters long, with a trend towards longer passwords as processing speeds increase, to enhance security against attacks.

💡Password Age

Password age refers to the duration a password is valid before it needs to be changed. The script explains that passwords have an expiration timer, which prompts users to change their passwords periodically, such as every 30, 60, or 90 days, to maintain security.

💡Password Expiration

Password expiration is a security measure where passwords must be changed after a certain period to prevent the prolonged use of the same password, which could increase vulnerability. The script mentions that systems may notify users when their passwords are about to expire and require a change.

💡Password History

Password history is a record of previously used passwords that a system keeps to prevent the reuse of old passwords. The script notes that many systems remember password history to enforce the creation of new, unique passwords.

💡Password Manager

A password manager is a tool that securely stores and manages multiple passwords for different accounts. The script highlights the use of password managers to alleviate the burden of remembering numerous complex passwords, while also adding an extra layer of security to access the stored passwords.

💡Multifactor Authentication

Multifactor authentication is a security method that requires more than one form of authentication to verify the user's identity. The script mentions that password managers may require additional authentication credentials or multifactor tokens to access the stored passwords, enhancing security.

💡Passwordless Authentication

Passwordless authentication is a method of accessing systems without the need for a password, often using biometrics or personal identification numbers. The script discusses this as an alternative to traditional passwords to mitigate the risks associated with password reuse and memorization.

💡Just-in-Time Permissions

Just-in-Time (JIT) permissions is a security practice where temporary administrative access is granted for a limited time to perform specific tasks. The script explains that this approach minimizes the risk of unauthorized access by ensuring that users only have elevated privileges when absolutely necessary.

Highlights

Creating a password with high entropy makes it difficult for attackers to guess.

Avoid using single words or obvious information in passwords to prevent password spraying or brute force attacks.

Ideal passwords include a mix of upper and lowercase letters, numbers, and special characters.

Password length should ideally be at least eight characters, with increasing requirements due to system capabilities.

Using a phrase or set of words can result in longer, more secure passwords.

Password age is evaluated after a certain duration to determine if a password needs changing.

Many passwords expire after 30, 60, or 90 days, prompting users to change them.

Expired passwords can lock users out of their accounts if not changed in time.

Systems often remember password history to prevent password reuse.

Using different passwords for each account can prevent attackers from accessing multiple accounts with one password.

Password managers help users securely store and manage multiple passwords.

Password managers encrypt stored information and require additional authentication to access the database.

Operating systems and third-party providers offer built-in and standalone password manager solutions.

Enterprise solutions allow organizations to implement secure password management for all employees.

Password managers can generate new, random passwords and automatically fill them into forms.

Many people still reuse passwords across sites, making it easier for attackers to gain access to their data.

Passwordless authentication methods, like face recognition or personal identification numbers, are becoming more common.

Passwordless authentication can be used in conjunction with a password for added security.

Just-in-time permissions allow technicians to receive temporary administrative access for specific tasks.

A central clearinghouse manages just-in-time permissions based on predefined security policies.

The just-in-time process creates temporary credentials that are deleted after use, protecting primary credentials.

Transcripts

When you're choosing a password, you often

see instructions on creating a password that will be

difficult for someone to guess.

This would prevent an attacker from using

some type of password spraying or brute force attack.

The goal is to create a password with an increased

amount of entropy.

Entropy describes how unpredictable a password

might be.

To meet those requirements, you don't

want to use single words or something

that might be obvious.

Ideally, you'd create a password that

included upper and lowercase letters, numbers,

and special characters all in the same password.

And you've probably seen cases where there is

a minimum length of a password.

Ideally, you'd want a password that

is at least eight characters, although we're

seeing password requirements increase

that number as the processing speeds

and capabilities of our systems become that much more

efficient.

In some cases, we're encouraged to use a phrase or set of words

so that we have a much longer password.

Once a password is set, a timer starts

that defines the password age.

This password age is then evaluated

after a certain duration to determine whether we would

want to change that password.

For example, many passwords will expire in 30 days, 60 days,

90 days, or some other value.

You've probably seen notifications that remind you

that your password is going to expire

in a certain number of days and that you'll

need to change this password as soon as possible.

If you don't change the password and the password expires,

then you won't be able to log in to that account.

And many systems will remember your password history,

so you can't reuse a password that you

may have used in the past.

Of course, these password expirations

are determined by the system administrator.

If this is a critical system, you

may find that your passwords need to be changed every 15

days or 7 days so that you constantly

have a different set of passwords in use.

The best practice is to use a different password

for each account.

This would prevent somebody from gaining access

to one of your passwords and being

able to access many accounts with those same credentials.

The problem, of course, is remembering

all of these different passwords across all

of these different accounts.

For that reason, we may want to take advantage of a password

manager.

A password manager allows you to store all of your passwords

in one single database.

This database obviously contains a great deal

of sensitive information, so we add additional security

to gain access to that database.

For example, the password manager

itself encrypts all of the information

stored in the database.

And to gain access to the database,

you may need to provide additional authentication

credentials or multifactor tokens.

Many operating systems are including a password manager

built into the OS itself, and you

can download and use many third-party password managers

as well.

There are also solutions available for the enterprise

so you can have every employee in your organization taking

advantage of using a secure password manager.

Once you log into your password manager,

you have full access to all of the saved passwords,

and you can get a summary of how healthy those passwords might

be.

This might give you some feedback

on whether a password may have been compromised

or whether you need to make passwords a bit more secure.

I like the feature in my password manager

that allows me to generate new passwords automatically

with a random amount of data and to automatically

add those to the form that I'm filling in.

This allows me to easily create unique passwords for every site

that I use.

Unfortunately, many people don't take advantage

of password managers or they tend to reuse passwords

across different sites.

This makes it very easy for an attacker to gain access

to a user's data.

Because of this, many systems have

moved to a passwordless method of authentication

where you would not use a password to log into a system.

This would certainly solve the problem of password reuse,

and you don't have to remember a password to log into a system.

You might already be using passwordless authentication.

If you have a mobile phone and you

unlock that phone with a face recognition,

you didn't have to put in any password

to gain access to that system.

And when I log into Windows, I use a personal identification

number instead of using a password.

In all of these cases, the passwordless authentication

is often used in conjunction with a password

or some other type of authentication factor.

This means that we may need to use our password initially.

But from that point forward, we can

use the passwordless authentication.

The use of passwords becomes much more

complex in an environment where you have many people logging

into many different systems, as we do in many IT departments.

So instead of using single passwords that

are assigned to an individual user,

we use just-in-time permissions.

This allows a technician to receive administrative access

for a limited amount of time using a set of credentials

that is also temporary.

This solves the problem of a technician

needing administrator rights but not

having those rights normally associated with their login.

This allows the technician to use those administrator

rights to solve a particular problem or fix an issue,

and then those rights will time out normally.

This means, if an attacker does manage

to breach an individual user's account,

they would not have administrator access

to the systems.

To start this process of just-in-time permissions,

the user would request permission

from a central clearinghouse.

This clearinghouse is responsible for allowing or not

allowing access based on a set of security policies

that were previously configured.

That central clearinghouse or password vault

contains primary credentials that would allow someone access

to a system.

But instead of handing out those primary credentials,

the vault is going to set different controls

for each individual user.

The just-in-time process is going

to create a new set of credentials

based on those primary credentials.

Those new credentials will be assigned to a user,

and they're assigned on an ephemeral basis, which

means they will only be temporarily assigned.

This means your primary credentials will never

be shown to anyone else.

And once the technician uses those temporary credentials,

they can then be deleted after that session is complete.