A comprehensive simulation tool for the analysis of password policies

Shay, Richard; Bertino, Elisa

doi:10.1007/s10207-009-0084-3

Cited by 20 publications

(7 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We consider similar data, but for a much larger set of users, allowing us to evaluate the effectiveness of various requirements more comprehensively. Other findings suggest that too-strict policies (those that make creating and remembering passwords too difficult) induce coping strategies that can hurt both security and productivity [1,20,36,37,40]. Further, Florêncio and Herley found that the strictest policies are often used not by organizations with high-value assets to protect, but organizations that do not have to compete on customer service [17].…”

Section: Background and Related Workmentioning

confidence: 99%

Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms

Kelley¹,

Komanduri²,

Mazurek³

et al. 2011

101

116

View full text Add to dashboard Cite

Text-based passwords remain the dominant authentication method in computer systems, despite significant advancement in attackers' capabilities to perform password cracking. In response to this threat, password composition policies have grown increasingly complex. However, there is insufficient research defining metrics to characterize password strength and evaluating password-composition policies using these metrics. In this paper, we describe an analysis of 12,000 passwords collected under seven composition policies via an online study. We develop an efficient distributed method for calculating how effectively several heuristic password-guessing algorithms guess passwords. Leveraging this method, we investigate (a) the resistance of passwords created under different conditions to password guessing; (b) the performance of guessing algorithms under different training sets; (c) the relationship between passwords explicitly created under a given composition policy and other passwords that happen to meet the same requirements; and (d) the relationship between guessability, as measured with password-cracking algorithms, and entropy estimates. We believe our findings advance understanding of both password-composition policies and metrics for quantifying password security.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms

Kelley¹,

Komanduri²,

Mazurek³

et al. 2011

101

116

View full text Add to dashboard Cite

show abstract

“…Passwords that are more random (through composition policies or system generation) or contain more characters are harder for password crackers to guess [14]. However, users have trouble remembering random or complex passwords [7,16] and resort to insecure workarounds, such as writing down the password or following predictable patterns to meet password requirements [13,15,24,27,3,23].…”

Section: Related Workmentioning

confidence: 99%

Pitfalls in the automated strengthening of passwords

Schmidt

Jaeger

2013

Proceedings of the 29th Annual Computer Security Applications Conference

View full text Add to dashboard Cite

Passwords are the most common form of authentication for computer systems, and with good reason: they are simple, intuitive and require no extra device for their use. Unfortunately, users often choose weak passwords that are easy to guess. Various methods of helping users select strong passwords have been deployed, often in the form of requirements for the minimum length and number of character classes to use. Alternatively, a site could modify a user's password in order to make it more secure; strengthening algorithms have been proposed that extend/modify a user-supplied password until achieving sufficient strength. Researchers have suggested that it may be possible to balance password strength with memorability by limiting automated changes to one or two characters while evaluating the generated passwords' strength against known cracking algorithms. This paper shows that passwords that were strengthened against the best known cracking algorithms are still susceptible to attack, provided the adversary knows the strengthening algorithm. We propose two attacks: (1) by strengthening the data sets with the known algorithm, which increases the percentage of recovered passwords by a factor of 2-5, and (2) by a brute-force attack on the initial passwords and space of possible changes, recovering all passwords produced when a sufficiently weak initial password was suggested. As a result, we find that the proposed strengthening algorithms do not yet satisfy Kerckhoffs's principle.

show abstract

“…There are a number of works which model user security behaviour in organisations, focusing on security policies such as password use [16] [17] and USB data transfer [15]. Model outputsrather than user reports -inform management decisions, with data that exposes the drivers for visible user behaviour.…”

Section: Related Workmentioning

confidence: 99%

A technique for using employee perception of security to support usability diagnostics

Parkin

Epili

2015

2015 Workshop on Socio-Technical Aspects in Security and Trust

View full text Add to dashboard Cite

Problems of unusable security in organisations are widespread, yet security managers tend not to listen to employees' views on how usable or beneficial security controls are for them in their roles. Here we provide a technique to drive management of security controls using end-user perceptions of security as supporting data. Perception is structured at the point of collection using Analytic Hierarchy Process techniques, where diagnostic rules filter user responses to direct remediation activities, based on recent research in the human factors of information security. The rules can guide user engagement, and support identification of candidate controls to maintain, remove, or learn from. The methodology was incorporated into a prototype dashboard tool, and a preliminary validation conducted through a walk-through consultation with a security manager in a large organisation. It was found that user feedback and suggestions would be useful if they can be structured for review, and that categorising responses would help when revisiting security policies and identifying problem controls. Keywords-information security; analytic hierarchy process; security policies; human factors of securityI.

show abstract

A comprehensive simulation tool for the analysis of password policies

Cited by 20 publications

References 10 publications

Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms

Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms

Pitfalls in the automated strengthening of passwords

A technique for using employee perception of security to support usability diagnostics

Contact Info

Product

Resources

About