Securing ASA/PIX Security Appliance Usernames and
Passwords
You should develop a password policy that helps to ensure that
attackers cannot obtain access to your security appliance. In this book, the
ASA/PIX Security Appliance is the most critical device in the network, and
password protection is stressed in many different parts of this book.
Passwords should be at least eight characters and should have
upper- and lowercase characters as well as special characters (numerals and
+_)(*&^%$#@!). The password should never be a word that can be found in a
dictionary. Many password-cracking programs available on the Internet assist
hackers in breaking into password-protected devices or parsing and decrypting
password files or password hashes. Because an eight-character password is
difficult to remember, you might want to match your password to an
easy-to-remember phrase. For example, the password Slatfatf42 could be matched
to the phrase "so long and thanks for all the fish 42." Many administrators take
it a step further and use obscure usernames as well as passwords. Instead of
using admin or root, they use the same guidelines as passwords—a minimum of
eight characters that should have upper- and lowercase characters as well as
special characters (numerals and +_)(*&^%$#@!). The downside, of course, is
that these names and passwords might be hard to remember. The upside is that it
becomes exponentially difficult for a hacker to break into the security
appliance with a brute-force password attack.
NOTE
Unless it's absolutely necessary, you would never allow
management access to your security appliance from the outside. This would open
the door for one of the oldest attacks on record, a brute-force password attack
from the Internet. Not allowing management access from the outside also ensures
that if a hacker wants to break into your security appliance, the hacker must
first compromise a system on the inside. With defense in depth applied, this is
a difficult, if not impossible, task. If you must allow management from the outside, you
should use IPSec/VPN as the secure management connection.
Sections
Comments (0 posted)
Syndication
