Lesson 3

Lesson 03 – Security Policies

Briefly define the terms below. For each definition include an example to demonstrate your understanding: Dictionary attack, brute force attack, key logger, network sniffer.

Password Policies & Account Lock out – briefly describe a password policy and account lockout that are enforced on your email account (perhaps provided by Hotmail, Gmail or Yahoo) or an e-commerce website of which you are a customer.

Dictionary Attack

A dictionary attack is a technique to gain unauthorised access on a password-protected computer by systematically submitting dictionary words until the correct password is discovered and in this way attempts to defeat the authentication process.

Dictionary attacks succeed because users commonly apply ordinary words for passwords which can be readily found in a dictionary.

For example, a type of dictionary attack used by hackers is to send messages to random e-mail addresses containing lists of christian names and/or individual letters of the alphabet followed by surnames (such as jshea, hwarson, or athompon) together with a domain name. 

^Reference:

^{1. https://www.techopedia.com/definition/1774/dictionary-attack}

Brute Force Attack

A brute force attack is a technique relying on a series of guesses to obtain encrypted user information such as passwords or personal identification numbers by using automated software to generate consecutive attempts to decipher the value of the encrypted data. As the password’s length increases the time, on average to find the correct password also increases.

Examples of software that generate brute force attacks include Haschat, John the Ripper and L0phtCrack.

^Reference:

^{1. http://searchsecurity.techtarget.com/definition/brute-force-cracking}

^{2. https://en.wikipedia.org/wiki/Brute-force_attack}

Keylogger

A keylogger is a form of spyware with the capability to record consecutive keystroke made, to a covert log file and subsequently sending this file to a specified receiver. 

^Reference:

 ^{1.  http://searchmidmarketsecurity.techtarget.com/definition/keylogger}

 ^{2. https://www.techopedia.com/definition/4000/keylogger}

Network Sniffer

 A network sniffer is a program utility with the capability of capturing data as it is transmitted, from a particular computer on a network. It can be used to diagnose network problems, or in a malicious manner to capture sensitive information from encrypted login sessions like usernames and passwords.

^References:

 ^{1. http://www.computerhope.com/jargon/s/sniffing.htm}

 ^{2. http://hitachi-id.com/concepts/packet_sniffer.html}

Account Lockout Policy 

An Account Lockout Policy specifies the number of unsuccessful login attempts that will cause a user account to become locked. 

For Apple’s e-commerce sites including the iTunes Store, App Store and the iBooks Store, a user account is locked after six failed attempts to login. By locking the software the account cannot be used until it is either reset by an administrator or the time period specified by the Account Lockout Duration Policy has elapsed.

Apple’s initial lockout duration is 10 minutes but continued failed attempts to login will increase the lockout period and finally a permanent locking of the account occurs. Reactivation of the account then requires the answering of security questions to allow resetting of the password.

Password Policy

A password policy is a set of rules improve computer security by encouraging users to use strong passwords appropriately and are designed dependent on the security needs of an organization and/or its clients. For example, password policies can specify minimum password length, prohibit blank passwords, set validity periods after which the password must be updated, prevent users from reusing passwords and ensure that specific characters are used in passwords to make the passwords more resilient to dictionary and brute forces attacks.  

For e-commerce sites such as the iTunes Store, App Store and the iBooks Store Apple apply the following password policy to protect users:

• Initial biometric or password login user authentication to access the Apple device 

• The entering of the user’s Apple ID and password into the system at authentication time when initially entering any of the e-commerce sites
• Upon making a purchase, the re-entering of your password, even if signed in with your Apple ID 

Apple Password Policy rules require:

• Use of strong passwords with a minimum of 8 characters in length and must contain a mixture of lower and uppercase letters and at least one number. The addition of extra special characters and punctuation marks is optional.
• No re-using of password.

^References:

 ^{1. https://technet.microsoft.com/en-us/library/dd277400.aspx}

 2. https://support.apple.com/en-au/HT204030

 ^{3. https://support.apple.com/en-us/HT201303}