ABSTRACT

Passwords are a critical component of data and network security. Passwords are the most common way to protect user accounts, but a poorly chosen password can put the entire network at danger if it is compromised. Many users are unaware of the importance of strong passwords and password management in information systems. We’re safe and sound! Passwords are used! How many of us are familiar with this assertion? Alternatively, we’re safe! There is a password policy in place! In today’s world of computing, using a password or having a password policy is insufficient. It is critical to understand and follow the policy in order to keep your account secure.

INTRODUCTION

This project gives a broad overview of security, including its goals, general approaches, and a more detailed description of the techniques used for user authentication, such as passwords. Finally, it discusses password policy, which is a necessary component of creating secure passwords.

SECURITY

With the rapid expansion of computer and network systems, security has become a key concern. Security refers to the safeguarding of confidential information from unauthorized or illegal access. Security is a step that must be taken on a daily basis, such as when using your website accounts and creating passwords, when flying and going through security checkpoints, when opening accounts in banks or government offices and showing your identification card, and when working in an office or studying at a university and having to swipe your card to open the doors. As a result, security has evolved into a resource for staying safe in the face of adversity.

COMPUTER AND NETWORK SECURITY

It is not irrelevant to define “computer and network security.” The challenge is coming up with a definition that is broad enough to be useful. Computer security, according to Dieter Gollman, is the prevention and detection of unlawful actions by users of computer systems, as well as the measures we can take to cope with intentional actions by parties behaving in an unfavourable manner. The abbreviation “CIA” can be used to classify three areas of computer security, which are most usually referred to as the CIA model:

Confidentiality – Ensuring that information provided by users to security is not accessed by unauthorised individuals.

Integrity – Ensuring that an unauthorised person does not change any of the authorised user’s information in an untraceable manner.

Authentication ensures that the person authorising is the right person who needs to be authorised.

Access control, non-repudiation, accountability, and privacy are all aspects of computer security that must be considered in the future. While numerous strategies are employed to protect computers against attackers, most computer crimes are believed to be performed by insiders, and most computer security research since 1970 has focused on the insider problem.

SECURITY THREATS

Logic attacks and resource assaults are the two most common types of security risks.

Logic assaults are known to take use of existing software faults and vulnerabilities in order to bring a system down. This technique is sometimes used to deliberately decrease network performance or provide an intruder access to a system.

Attacks on essential system resources like CPU and RAM are called resource attacks. Multiple IP packets or faked requests are frequently used to accomplish this. Viruses A software virus is a parasitic application that is designed with the goal of altering data on a computer without the user’s awareness.

Viruses are typically transmitted via email attachments and malicious files.

While customers are using an application to run their applications or instal software, adware shows advertising banners or pop-ups on their computer. Adware isn’t a problem unless it instals itself on the computer without permission and begins running undesirable software in the background, resulting in more banners and pop-up windows. Hijacks the web browser in order to display additional ad banners.

Unauthorized users can employ backdoor Trojans to get control of an authorised user’s machine over the internet without their permission. When the Trojan starts up, it adds itself to the startup process and begins monitoring the user’s computer until the user connects to the internet.

SECURITY TOOLS

INTRUSION DETECTION SYSTEM INTRUSION DETECTION

Intrusion Detection (ID) is a system that gathers and analyses data from various areas of a network or a computer in order to identify a possible security attack from someone attempting to break into or compromise a computer. Intrusion Detection Systems can be classified in a variety of ways (IDS).

 Misuse detection vs. Anomaly detection

The IDS analyses the data it collects and compares it to massive databases of attack signatures in order to detect misuse. In essence, the IDS searches for a specific attack that has already been reported.

The baseline, protocol, and normal packet size are all defined by the administrator in anomaly detection. The anomaly detector monitors network segments to compare their state to the normal baseline and look for anomalies.

Network based vs. Host based systems

Individual packets travelling via a network are evaluated in a network based system [NIDS]. The purpose of this system is to detect malicious transmissions. It connects to a network hub to receive access to network traffic. NIDS can be installed as a software package on a network-connected workstation. NIDS works in the same way as high-end antivirus software. The graphic depicts a typical NIDS scenario in which an attempt has been made to boost network traffic using NIDS devices. NIDS is an acronym for National Information Distribution System. A host-based intrusion detection system (HIDS) comprises of an agent on a host that analyses application log files to detect intrusions. It is straightforward to evaluate because it is installed locally on host PCs.

 Passive system vs. Reactive system

Threats are detected by passive intrusion detection systems, which then transmit alerts to the user. When malicious traffic is detected, the system provides an alert to the user, who can then decide whether to block it or respond to the notice. A reactive intrusion detection system not only detects the threat and alerts the user, but also responds to the threat with pre-defined proactive actions. Intrusion prevention system is another name for a reactive system (IPS).

FIREWALLS

A firewall system can be consisted of many dissimilar devices and components. The main component is traffic filtering, which is commonly called Firewall. A firewall allows or blocks traffic into and out of a private network or the user’s computer. Firewalls can be either software-based or hardware-based.

A software firewall is a firewall that is installed on a user’s computer. Firewalls are installed on computers in the same way that other software is; they can be configured to meet the needs of the users in order to secure their systems from intruders. Software firewalls protect only the computer on which they are installed, not the entire network.

Hardware firewalls are network security devices that are incorporated into routers or stand-alone devices. It will protect all systems in the local network even if no configuration is made.

Types of Firewalls

1. A packet-filtering firewall is a router that filters packet content at the layer 3 and layer 4 levels. Packets are authenticated by firewalls using protocol, source and destination IP addresses, and port numbers. On routers and switches, packet filtering is commonly combined with an Access Control List (ACL). Since the filtering technique is performed at lower layer, there is difficulty with packet filtering as there is no way to verify source address.
2. Application gateway firewalls, as its name suggests, operate at Layer 7 of the OSI model, or the application layer. All packets travelling to and from the application layer are intercepted by these firewalls. When a client wants to connect to the internet, it first connects to the proxy server, which then connects to the internet.  And the proxy server acts on behalf of the client for hiding and shielding the information.
3. An address translation firewall is a firewall that increases the amount of IP addresses available while concealing the network addressing scheme. There are two types of address translation: network address translation (NAT) and port address translation (PAT) (PAT) The ability to modify the source and destination IP addresses is provided by network address translation. When a private address is utilised internally, this approach is employedNAT establishes a one-to-one link between internal and external IP addresses. Internally, port address translation allows for the use of private addresses while only using one public IP address. Clients can utilise PAT to access numerous resources using the same IP address because it has a one-to-many connection.

AUTHENTICATION

Authentication is the process of verifying the characteristics of the user through special permit, as a must for granting access to the system. Every time when users’ want to access a secure system, they need to pass through authentication process to prove their identity and get access to the system. Some system requires several authentication steps to reduce the risk of attacker using the system. Authentication process is the means to unlock your system, to get access to information in the system. In some system, where there is high security to keep the information secure, they provide re-authentication. In this process, users are essential to offer identity information for future security. Re-authentication process is commonly used for internet banking.

TOKEN-BASED AUTHENTICATION

Token-based authentication, where the user presents some physical or digital object to the computer that is only with the user, for providing the security. Tokens are planned to be unique and difficult to forge. But tokens are so simple to surpass on, take away or use wrongly. So token- based authentication is always used in combination with other authentication methods. Therefore, using token-based authentication increase the number of passwords, instead of decreasing them, this brings more difficulty for user’s then simplicity. Examples of token-based authentication are smart cards, USB tokens or onetime passwords to mobile device or email.

BIOMETRIC AUTHENTICATION

Biometric authentication, where the user presents themselves to the computer for examination, so that it recognize there characteristic and give access to them to the system. These characteristics are unique and cannot be replicated. Biometrics is often used as an ultimate replacement of passwords. There are two kinds of biometric authentication, physiological biometric authentication and behavioral biometric authentication. Physiological biometric authentication analyzes the physiological characteristics of an individual. Physiology is a branch of biology that deals with the functions and activities of life or of living matter (as organs, tissues, or cells) and of the physical and chemical phenomena involved. This biometric authentication deals with fingerprints recognition, face recognition, hand and finger geometry, iris recognition and DNA analysis. Behavioral biometric authentication analyze user based on the behavior, and the manner in which they conduct themselves through various activities.

KNOWLEDGE-BASED AUTHENTICATION

 Knowledge-based authentication (KBA), where the user gives secret information to the computer to recognize them, to get access to the system. Knowledge based authentication is mostly commonly referred to user password, which user creates with his own knowledge to access the system.

PASSWORDS

The password is a sequence of characters that can either be automatically generated by the system (system generated password) or selected by the entity or user (user defined password). Passwords are used with username to get access to the secure system. Passwords can range from a single character to passphrases, which can be hundreds of 20 characters in length and be comprised of series of words and phrases. The goal of a password is to authenticate a user. It is a piece of information that the user knows.

WHY DO WE NEED A PASSWORD?

Passwords are used to protect a system or account, in which users have their secret and personal information, in other words by using password user has secure their system or account from unauthorized user. A typical user has password for many purposes: logging in to web account, reading email, using social networks, using banking accounts, and many more the purposes go on. As the passwords keep on growing, the purpose to maintain secure account also keeps growing. The account is secure when it has secure password. User should never limit the password with personal information, as it is easy to guess and used by unauthorized user. User should create a strong password.

PASSWORD VULNERABILITY

Passwords are the weakest link in the network. Strong passwords are hard to crack or guess by unauthorized user, but easy to create and maintain. Knowing a password doesn’t make someone an authorized user.

Types of Password Vulnerabilities

1. Organizational or end user vulnerabilities

This vulnerability is about lack of awareness on the part of end users and the lack of password policy that are enforced in the organizations. There are almost 3 trillion (eightcharacter) password combination possible using 26 letters of the alphabet and 0 to 9 numerals. However, users like to create password that are easy to remember.

• Technical vulnerabilities

This vulnerability is about feeble encryption method and insecure storage of passwords on computer systems. When there is weak encryption method, it is easy to crack down password using password cracking software. Passwords should be encrypted in the way, as it is easy to remember by the user, but difficult to crack down.

PASSWORD CRACKING

Password cracking is the most used method to hack the account of the user. Cracking can be done in two ways low-tech method which is using social engineering and simply guessing password from user information and another is high tech method is using a password cracking software. High tech password cracking methods are dictionary attack and brute force attack. Social engineering Social engineering is the method of asking password, directly to the user. Hackers make a telephone call to the user and are able to convince the people by means of emotions and trick them to give the information. To escape from social engineering, there is only one way, user awareness. Training user to understand that secret information should not to be shared on telephone to unknown users. To escape from dictionary attack, user should be trained not to use common words, dictionary words. Brute force attacks can crack any password, in adequate time. Brute-force attacks try every combination of numbers, letters, and special characters until the password is discovered. It consists of systematically checking all possible keys until the correct key is found. In the worst case, this would involve traversing the entire search space. To get rid from brute force attack, the easiest way is to change password frequently. Users should be made aware of the password cracking techniques, so that they can escape from there password getting hacked, and loosing there secure information. For this purpose user should follow and understand the password policy.

PASSWORD POLICY

 Password policy, gives instruction to the users, how a password is supposed to be. Passwords are the key to get into users system to hack their information. Strong passwords should have length more than 8 characters. A good password has both upper and lower case letters, has digits and punctuation characters as well as letters, is easy to remember, so it does not have to be written down, is seven or eight characters long, and can be typed quickly so someone else cannot look over your shoulder. Passwords should not contain any words from the dictionary of any language. Many policies also notify user not to use previously used passwords. Instead of creating passwords with words, there is an alternative of creating a passphrase, which is the best means to secure your account and create the strong password.

Multiple passwords require users to create different password for different account. Many users feel it very hard, as it is complex to memorize so many passwords and remember this password belong to this account. It also created more problems to user like forgetting password or forgetting to which account which password belongs. There are systems that often cancel a user’s access to the account after a password has been 22 entered incorrect for three times. Therefore there is compromise between user memory to remember many passwords and security of the system. User can generate numerous passwords but with same pattern, so that it’s easier for them to remember.

Password changing is the procedure of changing password frequently, at least once in the six months. Many users never follow this policy, they never change their passwords. Some user, use same passwords for years. Website accounts do not have this policy of altering password on regular basics, they never mind if their users are using same passwords. Universities and banking websites have this policy as they mail users that their password has to be changed as it has not been changed in last 6 months. Changing password regularly secures user from high tech password cracking method.

Password reuse is the problem of reusing same password for multiple accounts or using same password frequently while changing password. Users should be made aware of troubles while reusing same passwords. Users should be made clear with the policy of not reusing password. They should be told that they can use similar prototype for their passwords instead of using same password. When users are reusing their passwords, they are giving easy access to unofficial users.

Writing down Passwords- It is hard for human mind to memorize many passwords for multiple accounts. The easiest way to remember is writing down it on paper or any device or having a copy in mail. Users should be well-versed while creating passwords, that they should never write their passwords anywhere or share with anyone. Password is the secret which has to be secret. Writing down passwords for easy access can give access to unauthorized person also, if he got our password. Sharing passwords over phone or mail should also be avoided, as there can be a man in the middle, who can get our password. Then it gives access to him to authorized users account.

Dictionary words are used by users to compose their passwords. Some users attempt to use mixing of 2 or 3 dictionary words to create a single password. While some users try to use words from other countries language dictionary. Users should be given information regarding usage of dictionary words from local language dictionary or other foreign language dictionary, can be hacked and easily get access to authorized account. Dictionary attack is performed on the authorized account to find the password, if it has dictionary password, then hacker unauthorized user get complete access over authorized account.

Using personal information to create passwords like nickname, date of birth, telephone numbers, school or university name, parents, siblings or close friends name, street name, and etc. There are many users who utilize personal information as their passwords; such users should be made aware of security of using unsecure password. Securing passwords from outsider is the main issue to understand.

To secure your accounts from stranger, best practice is to create strong passwords, change passwords frequently on regular basics, never sharing passwords with anyone, erasing the habit of writing down passwords, never using personal information and not using same password for multiple accounts.

BIBLIOGRAPHY

https://tomssl.com/2016/10/21/a-sensible-password-strategy/

https://www.connectsafely.org/tips-to-create-and-manage-strong-passwords/

https://www.journalofaccountancy.com/issues/2009/jul/20081305.html

Kali Linux- An Ethical Hacker’s Cookbook

Aishwarya Says:

I have always been against Glorifying Over Work and therefore, in the year 2021, I have decided to launch this campaign “Balancing Life”and talk about this wrong practice, that we have been following since last few years. I will be talking to and interviewing around 1 lakh people in the coming 2021 and publish their interview regarding their opinion on glamourising Over Work.

If you are interested in participating in the same, do let me know.

Do follow me on Facebook, Twitter  Youtube and Instagram.

The copyright of this Article belongs exclusively to Ms. Aishwarya Sandeep. Reproduction of the same, without permission will amount to Copyright Infringement. Appropriate Legal Action under the Indian Laws will be taken.

If you would also like to contribute to my website, then do share your articles or poems at adv.aishwaryasandeep@gmail.com

We also have a Facebook Group Restarter Moms for Mothers or Women who would like to rejoin their careers post a career break or women who are enterpreneurs