Password policy: the good, the bad, and the ugly

Abstract

We're secure! We use passwords! How many of us have heard this claim? Or even -- We're secure! We have a password policy! Using a password or having a password policy in today's world of computing is not enough. Passwords provide a first line of defense in most cases, but there is much more. A recent survey by Rainbow Technologies Inc. indicates that the use of insecure passwords can be costly -- and potentially risky -- for corporate data. [Rosencrance] This paper focuses on the use of passwords and password policy and looks at the good, the bad and the ugly scenarios that arise.