MCSE Boot Training Camp  

Account Lockout and Password Concepts

 
Passwords are an important step in a security plan for your network. Users may see passwords as a nuisance; however, the security of your enterprise relies on a combination of password length, password uniqueness, and password lifespan. These three items help defend against dictionary attacks and brute force attacks. A dictionary attack occurs when a malicious user tries known words that are in the dictionary and a number of common password names to try and guess a password. A brute force attack occurs when a malicious user tries all of the possible permutations until one is successful.

Because most users prefer passwords that they can easily remember, dictionary attacks are often an effective method for a malicious user to find a password in significantly less time than they would with brute force attacks. Therefore, the strength of a password depends on how many characters are in the password, how well the password is protected from being revealed by the owner, how well the password is protected if it is intercepted by a malicious user on the network, and how difficult the password is to guess. Even good passwords that are protected by cryptography on the network and that are not subject to dictionary attacks can be discovered by brute force in a few weeks or months by a malicious user who intercepts the password on the network.

Currently, several attack methods are based on guessing weak passwords by using dictionary and brute force attacks. For a few simple ways to help prevent these attacks, see "Protecting from External Lockout Denial of Service Attacks" in this document for ports to block and registry values that you can set to help prevent such attacks.

Frequently, a malicious user will guess a number of passwords during a password-based attack. To help prevent the attacks from being successful, you can configure account lockout settings. The result of this configuration is that the associated account is temporarily disabled after a specified number of incorrect passwords are tried. This helps to prevent a successful attack by preventing the account from being used. However, a legitimate user cannot use that account until it is unlocked. This paper discusses the balance between the benefits and risks of account lockout.

Understanding Password Complexity

A complex password that is enforced by the operating system is one of the most effective methods that you can use to deter the opportunity for a successful attack. When you configure both an expiration time and a minimum length for a password, you decrease the time in which a successful attack could occur. For example, when you enforce password complexity with a password length of 6 and set the password to expire in 60 days, a user can choose from a permutation of:
• 26 lowercase characters
• 26 uppercase characters
• 32 special characters
• 10 numbers

This means that:

• 26 + 26 + 32 + 10 = 94 possible characters in a password
• Password length policy = 6
• 946 = 689,869,781,056 unique password permutations

With a 60-day password expiration time, the malicious user would have to make 133,076 password attempts every second to attempt all of the possible passwords during that password's limited lifetime. If it takes only 50 percent of the permutations to guess the password, a malicious user would have to attempt to log on to the computer about 66,538 (133,076 * .50) times every second to discover the password before it expires.

To decrease the chances that a malicious user has to discover the password, you can use a password length of 7. When you set the minimum password length to 7, the possible password permutations exceed 64 trillion (947= 64,847,759,419,264). When you compare the calculations above that have a password length of 6 to the calculations below that have a password length of 7, you will notice that the malicious user would have to log on to the computer about 6,254,606 times for each second that the password is valid in the 60-day expiration time that you set.

The following list describes how increasing password length deters both dictionary and brute force attacks. Note that the examples that are in this list assume that you are have applied a policy that requires users to create complex passwords. When you do this, there are 94 possible characters from which the users can choose their password.

• 6 characters: 9466 = 689,869,781,056
• 7 characters: 9477 = 64,847,759,419,264
• 8 characters: 9488 = 6,095,689,385,410,816
• 9 characters: 9499 = 572,994,802,228,616,704
• 10 characters: 941010 = 53,861,511,409,489,970,176
 
Note:
  A few of these password possibilities are not valid. By default, users cannot choose any part of their user name for their password and they cannot use all of the same characters as a password. Because of this, these password possibilities must be deducted from the total number of possible passwords that are listed above. Because there are very few passwords that apply to these exceptions and because the number of passwords that do apply to these exceptions can vary (based on the number of letters that are in the user's logon name), this document does not account for these exceptions.

These statistics explain how difficult it is for a malicious user to discover a password when you require the users in your network to use a complex password. Because of this, Microsoft recommends that you enforce a complex password policy that requires users to choose passwords with a specific number of characters for the security needs of your organization. The "Password Policies Settings" section in this document describes the complex password policies and settings for Microsoft® Windows NT® Server 4.0, the Windows® 2000 family, and the Windows Server 2003 family of operating systems.

Microsoft recommends that you use the account lockout feature to help deter malicious users and some types of automated attacks from discovering user passwords. The following section provides more information about how you can use the account lockout feature.

Authentication

Authentication is the process of validating a user name and password on a domain controller for:
• The initial logon to either a workstation or domain that uses the CTRL+ALT+DELETE secure logon sequence.
• An attempt to unlock a locked workstation by using the CTRL+ALT+DELETE secure logon sequence.
• An attempt to type a password for a password-protected screen saver.
• A user, script, program, or service that attempts to connect to a network resource by using either a mapped drive or a Universal Naming Convention (UNC) path.
 
 
  An account that is locked out may still be able to gain access to some resources if the user has a valid Kerberos ticket to the resource. The ability to access the resource ends when the Kerberos ticket expires. However, neither a user who is locked out nor a computer account can renew the ticket. Kerberos cannot grant a new ticket to the resource because the account is locked out.

There are two primary authentication protocols used by Windows: NTLM and Kerberos. This paper assumes you are familiar with these authentication protocols and does not focus on authentication details. Instead, the focus is placed on how authentication plays a role in account lockout. For more information about authentication protocols, see online help in Windows XP and the Windows Server 2003 family.

Vibrant CCNP Boot camp offers Payless MCSE boot camp, Payless MCSE training boot camp, Payless MCSE certification boot camp, Payless MCSE Cisco Boot camp, Payless MCSE Certification training boot camp. Payless MCSE Training certification boot camp, Payless MCSE Boot Training Camp, Payless MCSE boot certification camp, Payless MCSE UK Boot camp, Payless MCSE san Mateo Boot camp, Payless MCSE Japan boot camp, Payless MCSE USA Boot camp, Payless MCSE Europe Boot camp, Payless MCSE guaranteed boot camp.

  • Do you want to become  Real MCSE, CCNA or CCNP certified?
     
  • Do you want to Payless for certification?
     
  • Do you want to finish in 2/3 weeks?
 

 

MCSE Boot Camp, CCNA Bootcamp, CCNP Boot camp training in UK, USA, JAPAN, India
CCNA Training, MCSE Training, A+ Certification, MCSA, CCNP, Network+, Security+, CISSP, MCSD, CCSP,

MCSE Bootcamp Training - Cheapest, Fast, Guaranteed MCSE certification

 

MCSE Guide

Free MCSE
Free MCSE Training
MCSE
MCSE 2003
MCSE Books
MCSE Boot Camp
MCSE Brain dumps
MCSE Certification
MCSE Exam
MCSE Free
MCSE Jobs
MCSE Logo
MCSE Online
MCSE Online Training
MCSE Practice
MCSE Practice Exams
MCSE Practice Tests
MCSE Requirements
MCSE Resume
MCSE Salary
MCSE Self Paced Training Kit
MCSE Study
MCSE Study Guide
MCSE Study Guides
MCSE Test
MCSE Testing
MCSE Training
MCSE Training Kit
MCSE Training Video
MCSE Windows 2003
Microsoft MCSE Training
Training MCSE
Windows 2003 MCSE

 

 

MCSE : Security Specialist

Dynamic IP Mapping

 

The advantage of dynamic tables that store IP mappings is that they are updated  automatically. To accomplish this, the dynamic tables use two services: Domain Name System (DNS) and Windows Internet Name Service (WINS). DNS and WINS perform the same functions as the Hosts and Lmhosts files, but without the need for manual configuration.

 

 

Domain Name System (DNS)

 

DNS is a method for naming computers and network services. TCP/IP networks use the DNS naming convention to locate computers and services through user friendly domain names. When a user enters a domain name in an application, the DNS service maps the name to an IP address. The DNS naming system is organized in a hierarchical fashion to allow scalability to large systems, such as the Internet. By using a hierarchical system to create domain names, the computers that store the domain name–to–IP address mapping records have mappings for only their area. These computers, known as DNS servers, only process queries for computers located in their respective areas. As the mappings in the area change, Windows 2003-based DNS servers are automatically updated with the new information.

 

 

 

Windows Internet Name Service (WINS)

 

WINS provides a distributed database for registering dynamic mappings of NetBIOS names used on a network. WINS maps NetBIOS names to IP addresses and allows NetBIOS names to be used across routers.

 

A WINS server is not required for a pure Windows 2003 network but is recommended for use in a mixed environment.

 

 

Name Resolution in Windows 2003

 

                         

 

Name resolution is the procedure by which a name is resolved, or mapped, to an IP address. When you enter a user-friendly name in an application, the application determines whether the name is a host or NetBIOS name. Current applications in Windows 2003 use the host name resolution process, but some older applications, such as those designed for Microsoft Windows NT, Windows 95, and Windows 98, still use NetBIOS names. If the name resolution process fails, then the application cannot communicate with the desired destination. If you use an IP address, name resolution is not needed.

 

 

Host Name Resolution Process

Host names can be resolved directly by the Hosts file or by a DNS server. The default name resolution procedure is as follows:

 

1. Computer A enters a command, such as FTP, by using the host name of Computer B.

2. Computer A checks to see if the specified name matches its local host name.

3. If not, then Computer A checks its Hosts file looking for Computer B’s host name. If it finds the host name, it resolves it to an IP address.

4. If Computer A does not find Computer B’s host name in the Hosts file, it sends a query to the DNS server. If the host name is found, it is resolved to an IP address.

5. If the host name is not found on the DNS server, Windows 2003 checks for the name in the NetBIOS name cache. It does this because Windows 2003 treats the NetBIOS name as the host name.

6. If the NetBIOS name cache does not have the host (NetBIOS) name, a query is sent to the WINS server.

7. If the WINS server cannot resolve the name, a broadcast message is sent out on the network.

8. If no host responds to the broadcast, the Lmhosts file is checked for the host (NetBIOS) name.

 


© Vibrant Worldwide Inc.