Go back to the archive

Choose strong passwords - A strong password should be at least 8 characters long and contain at least one character from each of the following character sets: lower case letters, upper case letters, numbers, and symbols.  They should not based on a dictionary word, personal information, or an easily guessed sequence of letters, numbers, or symbols. When changing passwords, new passwords should be completely different from previous passwords and not just modified versions of previous passwords. Do not store passwords where they can be easily discovered (on sticky notes on your monitor, in text files on your computer, and so on).

Reference links for more information:

How to create and use strong passwords
Strong passwords
SANS Password Policy Example

Many operating systems allow administrators to ensure users select complex passwords through security policies such as the "Passwords must meet complexity requirements" policy settings in the Windows operating systems (Technet article on Setting Password Complexity).

Administrators can check the security of user passwords on their systems through the use of password auditing tools such as:

John the Ripper

Ophcrack

 

© 2009 The Center for Infrastructure Assurance and Security