Hi Greg :)
Check out the CISSP Prep Guide by Ron Kurtz (sp) (white cover with
weird checkerboard like pattern of colors) for some of the math you are
asking about...
Short answer ... yes, If I know you require no less than 7 characters
and no more than 8 characters ... then I won't launch an attack at you
using 4 character passwords... much quicker...
Better answer: No time difference because your system should lock any
and all accesses out after no more than 3 missed authentication attempts
and should alert your pager via the method of your choice if your threshold
for failed attempts by bad user name is exceeded.
<Plug Alert>
Counterpane Internet Solutions can do this very well... for a price...
and yes we do use them... you will find our Chief Information Security
Officer quoted all over their website! And other than a good conference,
a baseball hat (good for us bald guys! hehe) and a tee-shirt no influencing
agents have been applied hehehe
<Plug Alert Off>
Art "just a thot or two " Bahrs
=======================================================
Art Bahrs, CISSP Information Security The Regence Group
(503) 225-4992 FAX (503) 220-3806
"Greg Stigers"
<gregstigers@S
PAMCOP.NET> To
Sent by: [log in to unmask]
"HP-3000 cc
Systems
Discussion" Subject
<HP3000-L@RAVE Re: [HP3000-L] passwords
N.UTC.EDU>
02/08/2006
01:04 PM
Please respond
to
"Greg Stigers"
<gregstigers@s
pamcop.net>
|------------|
| [ ] Secure |
| E-mail |
|------------|
<<<< snip >>>>
I suspect that finding out a company's password complexity requirements
cuts
the time to brute force dramatically, by allowing one to not test for
simple
passwords. I have no idea how to work out the math on that one.
Greg Stigers
* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *
=============================================================================
IMPORTANT NOTICE: This communication, including any attachment, contains information that may be confidential or privileged, and is intended solely for the entity or individual to whom it is addressed. If you are not the intended recipient, you should delete this message and are hereby notified that any disclosure, copying, or distribution of this message is strictly prohibited. Nothing in this email, including any attachment, is intended to be a legally binding signature.
=============================================================================
* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *
|
