User Manual

Enterasys X-Pedition User Reference Manual 31
Configuring CLI Access Security
Types of passwords to avoid:
– User’s name (first or last), child's name, or the name of a pet
– Birthday or anniversary
– “Password”
– Repeated characters (e.g., “AAAAAA” or “999999")
– Sports teams or terms (such as “Bulls” or “Golfer”)
– Favorite recording artist
– Obscenities or sexual terms
In addition to avoiding bad passwords, do not employ bad security practices:
– Do NOT write down the password and post it near the terminal.
– Do NOT use the login name and password of a former employee.
– Make sure that someone besides the network administrator knows the master account
username and password and tests them periodically. This prevents you from losing access
to your network should anything happen to the employee or if the relationship with that
employee deteriorates.
– Avoid using the master account for anything but administration. Using this account
frequently to perform mundane network operations can lead to unnecessary accidents.
– Many networks use “guest” accounts. Disabling these accounts will help maintain
appropriate access for the right people.
Computer programs used to hack passwords fall into two general categories: dictionary attacks and
brute force attacks. Dictionary attacks involve using words from a “dictionary” or database of
frequently-used terms to attempt to match the user password (e.g., names, cities, and sports teams).
Brute force attacks focus on discovering passwords via software that generates a sequence of
character combinations. For example, guessing a three-character password that uses only
alphabetical characters (A - Z) would involve testing all letter combinations between AAA and
ZZZ—a total of 17,576 possible combinations.
Strong Passwords
The strength of a password is proportional to its length and complexity—the longer the password,
the longer it takes to generate all possible combinations. A strong password is important because
password cracking tools continue to improve and the computers used to crack passwords are more
powerful than ever. Network passwords that once took weeks to break are now be broken in a few
hours. Table 3 depicts the relative strength associated with password length and the character types
allowed.