In this pocket guide, you’ll find essential information about main security controls. I will explain the concepts, risks, share real-world examples and some interesting, less obvious insights.
Idea
Password is an authentication method.
It is a string of characters which is created during sign-up (registration) between two parties. It is not supposed to be shared with any other parties. Thus, you can verify the identity of the party if it provides the correct password.
If the password is used for system-system communications, it is often called “secret”. Please do not confuse with “keys”, which is a form of certificate or public/private key authentication.
Application examples
When you connect to your Internet Bank, the bank authenticates you via username and password.
Risks
Weak password authentication is usually considered as “High” risk.
Brute-forcing is an old method of compromising passwords. Attacker enumerates all combinations of characters and hopes to hit the correct one. Having computer systems makes the enumeration fast and easy. Password lock-out is a defence mechanism against it. It works by “locking” the account after a certain number of authentication failures, preventing (or delaying) all further enumeration attempts.
Password guessing is another common attack. People tend to choose common, easy-to-remember, easy-to-predict passwords. Attacker can guess or enumerate passwords from the list of commonly used to gain unauthorised access to private resources. Password complexity rules are enforced to prevent people from using guessable passwords.
Password expiration rules are used just in case there is unnoticed password compromise, or to reduce the time window for the attacker to exploit the compromised password. I don’t think it is effective control in the age of fast computer programming.
Protection of passwords/secrets at rest is a whole topic on itself. We will discuss it in the Data protection article.
Quirks
Passwords are so effective and easy to implement that they become ubiquitous. That causes “too many passwords” problem for humans, who are not good at remembering numerous complex passwords. Several solutions have been developed to that problem, including password managers and passkeys. They “offload” memorising passwords to a software.
Another quirk is that enforcing too short a password expiration period causes people to choose weaker passwords. If the passwords are to be frequently changed, people care less, and select easier to remember strings.
Further reading
Pocket Guide: Authentication – Certificates
Pocket Guide: Two-Factor Authentication
Passkeys – how do they work and who needs them
Please check out the map of cyber security controls below. It is simple yet awesome.
