RE: iSeries Security in Computerworld

Joe Pluta wrote on 03/11/2006 05:01:58 PM:
 

And strong passwords aren't all that and a bag of chips anyway: as you 

well

know, John, strong passwords often lead to the post-it exploit.  Until 

we

get those retinal scanners on our workstations (or maybe the implanted
biochips), there's really no security at all.

Even using biometrics for authentication does not make a large dent in the 
effectiveness of social engineering attacks.  I think this type of attack, 
which includes the 'pretexting' stuff we've heard so much about recently, 
is probably a much greater concern for many organizations, but one which 
is not often addressed.

On the topic of passwords - is it possible to use passwords of more than 
10 characters for green screen users?  I read an article recently 
discussing password strength, the basic premise of the article was that 
length is more important than entropy.  The entropy rules that lots of 
places have - must include numbers, must have at least one 
non-alphanumeric character, must include capital letters, etc - are 
probably the biggest contributor to the post-it syndrome.  It seems that a 
simple rule password rule like 'your password must be more than 10 
characters in length and must not be a single dictionary word' would 
address the post-it problem, and improve security at the same time.  If 
you calculate the search space, a 12 character password containing only 
a-z is more secure than a 10 character password containing a-z,0-9, and 
all the punctuation you can think of.

Just some food for thought,
Adam

#####################################################################################
Attention:
The above message and/or attachment(s) is private and confidential and is 
intended 
only for the people for which it is addressed. If you are not named in the 
address 
fields, ignore the contents and delete all the material. Thank you. Have a nice 
day.

For more information on email virus scanning, security and content
management, please contact administrator@xxxxxxxxxxxx
#####################################################################################