In the last picture, we saw the same password management techniques.
Now we'll have a look at the guidelines for managing the passwords now why security audits are important.
I will discuss this after some time, but lawyers for timing will focus on the password management.
Now, using characters is very important.
Generally, we know that passwords are a combination of numbers, letters and special characters.
And by special characters, I mean the symbols that you can see on the screen right now.
Now, whenever you are using or whenever you are setting a new password, make sure that you use all
the combinations possible.
Don't just create a password of numbers or just simply letters include special characters because it
becomes really hard for the bad people, bad guys to actually get into the system.
For example, a vesicular is the password.
So resecured is an easy combination to guess.
But if you read the secure exclamation mark one eight zero five, then that becomes a very difficult
because whenever there is password cracking involved, that is mostly what we call a random attack,
brute force attack in which different combinations are tried and using different letters and special
characters.
So more the complex password, it becomes more difficult for the system to generate random numbers and
then start a brute forcing the password.
Now, the next thing, as I said earlier, W.S. one zero five Aderet and this and hash.
Now there are two special symbols which I have included now on many websites do allow all the special
symbols, but a few websites will have restrictions on using those symbols, but they will specify that
symbols are allowed while you are creating a new password.
So make sure you set a strong password with a combination of different numbers, letters and special
characters.
Also, you can include uppercase and lowercase characters as you can as you have experience with many
websites nowadays.
They make it compulsory to have one uppercase alphabet and lowercase alphabet along with one number,
and the password line should be at least seven to eight characters.
Now, there are various other tools for password cracking, which may check for a certain possibility
of password cracking.
This is if the system is taking too long, which means the password policy is good to go and the passwords
are really bad.
So you can use all the tools, like there are many tools available which have a password cracking feature.
So most auditors do use those tools while they are checking for passwords.
Now, the next important thing is locking out after a few unsuccessful attempts.
Many banking websites do employ this kind of policy that if a user tries to unlock a user, tries to
unlock the account, then if the fail after three to four attempts, the account gets automatically
disabled for a specific period of time.
Now, why?
This is a good thing because many bad guys have the option of brute force.
So if you brute force a password and if it fails, obviously it will fail for a few more random permutations
and combinations at that time.
If the system or the server detects that more number of unsuccessful attempts have been happened, the
account can be disable and hence this increases the security measure.
When it comes to password management, the next is disabling account.
Now, again, as I said earlier.
Disabling account is more beneficial than deleting or keeping the account as it is, so whenever someone
tries to have a successful account, unsuccessful attempts either lock out the entire account or just
disable the account for a specific period of time so that no one can really access the account.
Now, manually unlocking the account.
Yes, in some cases with extra security or server security, if the upper management or the person tries
his or her account gets logged, then he has or he or she has to manually contact the administrator
to unlock the account.
Now, this happens only in case where the accounts need to be very secure.
For example, let's say the upper management of the of those people have are very they have very secure
accounts and their information is very valuable to the firm.
And that is why they generally have to contact the IT department to in order to get such things done.
Now, in in many cases, it may happen.
In some cases it may happen that the administrator himself or herself forgets the password.
But, yeah, if you are an administrator, make sure that you carve the username and password in your
mind, because if you forget the password, then there's no going back.
However, when it comes to Windows of Windows and provides a different or another administrator account
apart from the original one, so that even if you're the second administrator account gets locked up,
the auditing administrator account is still available.
But you should always remember your password.
That is one way of getting your memory work for you.
So instead of writing down your passwords or noting down them on sticky notes and posting it on your
desk, eat almonds every day, it helps you to remember more.
And please remember your passwords because they are very crucial.
They are the first point of access for information, password history.
This is also very important when it comes to password management.
Now set passwords to expire after a fixed duration.
That is.
That is right.
OK, let me just get back here.
So what happens is most of the time we are so we are we we get so used to one password because we said
that password at every website.
So it is a good practice to expire to remove those passwords and generate a new password after a fixed
duration.
For most of the company, the duration is around 30 to 45 days.
But now, since the bad guys are one step ahead of the normal people, many organizations have started
using a different timeline.
For example, your password will expire after 26 days or your password will expire after 42 days.
And after that, the employees or the people have to again set a new password.
Now, setting a new password is a very good practice because the more the number of passwords are changed
frequently, the less hackers can hack the system and try to access your files and records.
As I said earlier, bad guys are one step ahead of the normal people or the employees, you have to,
you know, think like a bad guy.
Now, the bad guys know that the password is going to change after 30 or 45 days.
They may send a malicious link to the user on the 30th day saying that please change your password.
So in that case, you know, we have to set a different timeline for the individual company's employee
password history.
So password history is a great use because if if you try to let's say Google has a password history,
which doesn't allow you to keep the same password if it's already in the password history, for example,
generally password history stores up to 20 last at least use at least passwords, which means the last
20 passwords are already stored on the the machine or the server, and you're not allowed to use or
keep a password from one of them.
For example, I can give a password like resecure at three one eight zero five or W.S. it one zero five.
Then these two are different passwords.
But after, let's say, five to six items, I again try to reset my password resecure.
I didn't want to do it.
Will not allow me because this password has already been in the password history.
So make sure that you keep a new password and try to remember that password.
Now make it mandatory for users to change passwords.
Most of us are of the tendency that, you know what we have said one password.
Just keep it.
Just remember it and forget we'll set that password for every other account.
But it is a good practice to change the passwords.
Changing frequency is important, as I also said earlier, that bad guys can hack your systems.
But if your password changing frequency is very good, then it becomes very difficult for them to crack
the passwords.
Well, that is it for this lecture again, guys, if you are really enjoying this, cause if you have
learned something valuable, please read our course because we are lacking support from your side.
All you need to do to support us is to just give a rating and share your feedback through the reviews.
It will really help us and motivate us to draft more courses.
I will see you in the next lecture.