Password Audit

Passwords are one of the most important cornerstones of a successful information security program.   Bad passwords are one of the TOP RISKS facing information security departments and many companies have added passwords audits to their organization’s password policy.    A password audit begins with an engineer attempting to break the encryption on each password stored on your domain controller in order to identify weak passwords.   These decrypted passwords will then be reviewed to identify weaknesses in your policy or policy enforcement.

PeopleSec Recommends The Following:
  1. Require users have a password that is at least 12 characters.
  2. Remove complexity requirements to make it easier for users to remember their passwords.
  3. Use pass-phrases instead of passwords.
  4. Require users change their passwords at least once every 90 days.
  5. Educate users on how to choose a secure password.
  6. When storing passwords use an encrypted password storage tool.
  7. Test password strength by having a security engineer decrypt your passwords at least once a year.
61%

of people reuse the same password on multiple websites according to a study of password habits by CSID.

Password Audit