Management just funded an IS audit of the company. One of the things it picked apart was our password policy (or lack of one). With some of the projects we work with, auditors suggested we look to implement biometric login devices that would replace the use of a user-entered password. What should we look to do?
Management just funded an IS audit of the company. One of the things it picked apart was our password policy (or lack of one). With some of the projects we work with, auditors suggested we look to implement biometric login devices that would replace the use of a user-entered password. What should we look to do?
– Via the Internet
Depending on what you’re using for the server OS, there are several things the operating system may be able to help with. First you must require unique passwords. This means that at a basic level common passwords such as names or dates should be automatically rejected when the user tries to change them. Something else this step should do is track a certain number of passwords. This keeps your more “inventive” employees from continually entering a series of random passwords to get past the counter to where they can reuse their “standard” password. Requiring the use of a least one punctuation mark and possibly at least one capital letter will help the users come up with a password that will present a challenge for others to try to break. A good way to test this is to use some of the readily available tools you can download from the Internet, such as John the Ripper and others, that run a series of attacks against your login names to see if the passwords can be easily guessed or broken. Check with your server OS vendor to see what type of best practice documents it has to further help you devise a good password policy.
As to biometric, this can get costly depending on the type of system you choose. A finger scanner can run around $100 depending on the product; retinal scanners will cost even more. This doesn’t even cover the card reader devices that require you to swipe a card through a reader or a proximity card that will “unlock” a PC when you’re within a certain distance of the PC. For those who really have to know who’s logging in and to make that even harder, you can use a combination of devices that could require a finger scan and a badge to be swiped to access some files/projects and just a finger scan for general access. Although this gives a potentially higher level of security, this also means the level of administration and troubleshooting will probably go up as well. Make sure that management understands the flexibility of this option but just as importantly the costs of implementing and maintaining a sophisticated login system like this.
