WEBVTT

1
00:00.000 --> 00:00.060 align:middle line:84%


2
00:00.060 --> 00:02.070 align:middle line:90%
Hardening our passwords
seems like this

3
00:02.070 --> 00:05.070 align:middle line:90%
should be an obvious topic
or an obvious decision

4
00:05.070 --> 00:07.080 align:middle line:90%
when it comes to
our security posture

5
00:07.080 --> 00:08.700 align:middle line:90%
and how we protect
against threats.

6
00:08.700 --> 00:11.040 align:middle line:90%
But this is still one of
the most common attacks that

7
00:11.040 --> 00:13.290 align:middle line:90%
are around today
because ends users,

8
00:13.290 --> 00:16.500 align:middle line:90%
and even software developers
or IT professionals

9
00:16.500 --> 00:19.290 align:middle line:90%
still overlook and
ignore this threat.

10
00:19.290 --> 00:21.480 align:middle line:90%
So what we have to do in
this particular Nugget

11
00:21.480 --> 00:24.600 align:middle line:90%
is talk about how passwords
are really a vulnerability

12
00:24.600 --> 00:27.390 align:middle line:90%
and what mitigation steps we
can take to harden ourselves

13
00:27.390 --> 00:28.307 align:middle line:84%
against this problem.

14
00:28.307 --> 00:30.390 align:middle line:90%
Obviously, if we're going
to talk about passwords,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:28.307 --> 00:30.390 align:middle line:90%
Obviously, if we're going
to talk about passwords,

15
00:30.390 --> 00:32.700 align:middle line:90%
we have to talk about
password complexity.

16
00:32.700 --> 00:36.090 align:middle line:90%
And I recently found this
little infographic on Reddit.

17
00:36.090 --> 00:39.000 align:middle line:90%
Hive systems, I guess, are
the people who created this.

18
00:39.000 --> 00:40.500 align:middle line:90%
I think this is
really, really cool

19
00:40.500 --> 00:43.020 align:middle line:90%
of them to put this little
infographic out there

20
00:43.020 --> 00:43.738 align:middle line:84%
in the wild.

21
00:43.738 --> 00:44.280 align:middle line:84%
Look at this.

22
00:44.280 --> 00:49.230 align:middle line:90%
Look at the comparison
chart of how complicated

23
00:49.230 --> 00:50.550 align:middle line:84%
your password can be.

24
00:50.550 --> 00:52.500 align:middle line:90%
Over here we have the
number of characters

25
00:52.500 --> 00:54.240 align:middle line:84%
going from smallest to largest.

26
00:54.240 --> 00:57.000 align:middle line:90%
And over here, across the
top, across the x-axis,

27
00:57.000 --> 00:59.400 align:middle line:90%
we have password
complexity, so numbers only,

28
00:59.400 --> 01:02.010 align:middle line:90%
letters only, upper and lower
case, number upper and lower
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:59.400 --> 01:02.010 align:middle line:90%
letters only, upper and lower
case, number upper and lower

29
01:02.010 --> 01:03.360 align:middle line:84%
case, and then with symbols.

30
01:03.360 --> 01:07.020 align:middle line:90%
So if I had a 12
character password that

31
01:07.020 --> 01:08.880 align:middle line:90%
has numbers, uppers,
and lowercase,

32
01:08.880 --> 01:13.350 align:middle line:90%
I see that it can take 2000
years to crack that password.

33
01:13.350 --> 01:18.073 align:middle line:90%
Throw in one symbol and
that becomes 34,000 years.

34
01:18.073 --> 01:19.740 align:middle line:90%
And this begs the
question, how are they

35
01:19.740 --> 01:22.540 align:middle line:90%
attacking this password
in the first place?

36
01:22.540 --> 01:24.750 align:middle line:90%
Well, there's a bunch of
different ways, you see.

37
01:24.750 --> 01:26.880 align:middle line:90%
And that sets up the
discussion about why

38
01:26.880 --> 01:28.990 align:middle line:84%
this chart is so important.

39
01:28.990 --> 01:30.840 align:middle line:90%
The first way attacker
is going to attack
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:28.990 --> 01:30.840 align:middle line:90%
The first way attacker
is going to attack

40
01:30.840 --> 01:34.740 align:middle line:90%
a simple password is with
something called a dictionary

41
01:34.740 --> 01:35.400 align:middle line:84%
attack.

42
01:35.400 --> 01:38.910 align:middle line:90%
In about one Google search, I
can scroll down a hair here,

43
01:38.910 --> 01:41.850 align:middle line:90%
and I see these zip
files that contain

44
01:41.850 --> 01:45.690 align:middle line:90%
huge, huge amounts of
passwords that are simply

45
01:45.690 --> 01:48.540 align:middle line:90%
stored in Excel files,
or text documents,

46
01:48.540 --> 01:49.900 align:middle line:84%
or something like that.

47
01:49.900 --> 01:52.530 align:middle line:90%
And the idea is that we
have an application that

48
01:52.530 --> 01:54.700 align:middle line:90%
will go through each
one of these passwords

49
01:54.700 --> 01:57.690 align:middle line:90%
and try and log into a website,
or log into an application

50
01:57.690 --> 01:59.730 align:middle line:84%
trying one password at a time.

51
01:59.730 --> 02:02.170 align:middle line:90%
They're only looking to get
in once, that's the key.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:59.730 --> 02:02.170 align:middle line:90%
They're only looking to get
in once, that's the key.

52
02:02.170 --> 02:04.260 align:middle line:90%
So a dictionary attack
is all about using

53
02:04.260 --> 02:07.570 align:middle line:90%
a file that contains a
dictionary, so to speak,

54
02:07.570 --> 02:10.169 align:middle line:90%
of nothing but passwords that
it can try over, and over,

55
02:10.169 --> 02:12.330 align:middle line:90%
and over, and over
again, as it attempts

56
02:12.330 --> 02:13.800 align:middle line:84%
to break into the website.

57
02:13.800 --> 02:16.800 align:middle line:90%
This is why it's so important
to change your password.

58
02:16.800 --> 02:19.320 align:middle line:90%
There's another website
that I think is really cool,

59
02:19.320 --> 02:21.180 align:middle line:84%
have I been pwned?

60
02:21.180 --> 02:24.010 align:middle line:90%
You can type in your
email address right here,

61
02:24.010 --> 02:26.730 align:middle line:90%
and it will tell you
if your email address

62
02:26.730 --> 02:29.820 align:middle line:90%
and a matching password
appears somewhere

63
02:29.820 --> 02:33.390 align:middle line:90%
in its database or its
dictionary of leaked usernames
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:29.820 --> 02:33.390 align:middle line:90%
in its database or its
dictionary of leaked usernames

64
02:33.390 --> 02:34.320 align:middle line:84%
and passwords.

65
02:34.320 --> 02:36.900 align:middle line:90%
So there's your mitigation
steps to the dictionary attack

66
02:36.900 --> 02:37.590 align:middle line:84%
right there.

67
02:37.590 --> 02:40.440 align:middle line:90%
Just see if your email address
and password have already

68
02:40.440 --> 02:41.620 align:middle line:84%
been leaked somewhere.

69
02:41.620 --> 02:44.010 align:middle line:90%
So if your email address
and your password

70
02:44.010 --> 02:46.140 align:middle line:90%
aren't there out in
the wild, then it

71
02:46.140 --> 02:48.145 align:middle line:84%
comes into this play right here.

72
02:48.145 --> 02:49.770 align:middle line:90%
The next thing a
hacker will try and do

73
02:49.770 --> 02:52.470 align:middle line:90%
is what's called a
brute force attack.

74
02:52.470 --> 02:54.720 align:middle line:90%
With a brute force attack,
it will literally just

75
02:54.720 --> 02:59.070 align:middle line:90%
start trying random numbers,
characters, and so on over,

76
02:59.070 --> 03:01.180 align:middle line:90%
and over, and over
again until it gets in.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
02:59.070 --> 03:01.180 align:middle line:90%
and over, and over
again until it gets in.

77
03:01.180 --> 03:03.180 align:middle line:90%
And here's the thing,
with a brute force attack,

78
03:03.180 --> 03:08.520 align:middle line:90%
or even a dictionary attack,
it can try dozens, or hundreds,

79
03:08.520 --> 03:10.710 align:middle line:90%
or if it's powerful
enough, thousands

80
03:10.710 --> 03:12.780 align:middle line:84%
of passwords per second.

81
03:12.780 --> 03:15.060 align:middle line:90%
But because the
number of combinations

82
03:15.060 --> 03:16.680 align:middle line:90%
when you have this
many characters

83
03:16.680 --> 03:18.960 align:middle line:90%
and this many
possible characters

84
03:18.960 --> 03:22.740 align:middle line:90%
is so tremendous, even with
that kind of processing power,

85
03:22.740 --> 03:26.850 align:middle line:90%
it will still take an absolute
tremendous amount of time

86
03:26.850 --> 03:30.510 align:middle line:90%
for a hacker to brute force
their way into passwords.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
03:26.850 --> 03:30.510 align:middle line:90%
for a hacker to brute force
their way into passwords.

87
03:30.510 --> 03:32.790 align:middle line:90%
And this is why we have
things like password

88
03:32.790 --> 03:35.040 align:middle line:84%
policies in Active Directory.

89
03:35.040 --> 03:37.860 align:middle line:90%
The password policies
enforce a minimum number

90
03:37.860 --> 03:41.640 align:middle line:90%
of characters, a specific
combination of upper, lower,

91
03:41.640 --> 03:43.470 align:middle line:84%
number and symbols.

92
03:43.470 --> 03:45.750 align:middle line:90%
And beyond that, we have
to rotate new passwords

93
03:45.750 --> 03:49.170 align:middle line:90%
in every so many days so that
way if a password does get

94
03:49.170 --> 03:51.430 align:middle line:90%
leaked, by the time it
gets around the world,

95
03:51.430 --> 03:53.500 align:middle line:90%
we've already moved
on to a new password.

96
03:53.500 --> 03:56.760 align:middle line:90%
But this isn't the only way
that passwords can be exploited.

97
03:56.760 --> 03:59.700 align:middle line:90%
Software developers, especially
new software developers,

98
03:59.700 --> 04:02.760 align:middle line:90%
maybe like myself, tend
to hard code passwords
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
03:59.700 --> 04:02.760 align:middle line:90%
maybe like myself, tend
to hard code passwords

99
04:02.760 --> 04:04.170 align:middle line:84%
directly in their code.

100
04:04.170 --> 04:06.580 align:middle line:90%
And when a password is
sitting there in plain text,

101
04:06.580 --> 04:08.400 align:middle line:90%
if a hacker accesses
that system,

102
04:08.400 --> 04:10.830 align:middle line:90%
they can read the document
and see what the password is.

103
04:10.830 --> 04:12.090 align:middle line:84%
But it gets worse.

104
04:12.090 --> 04:14.520 align:middle line:90%
Now with the advent
of source control,

105
04:14.520 --> 04:16.950 align:middle line:90%
new developers can not
only write their code

106
04:16.950 --> 04:18.570 align:middle line:90%
and hard code the
passwords, they

107
04:18.570 --> 04:20.459 align:middle line:90%
can end up sharing
it with the world.

108
04:20.459 --> 04:23.760 align:middle line:90%
Here's my very own GitHub
repo, and here's a document

109
04:23.760 --> 04:26.010 align:middle line:90%
that I created when I was
going through the DevNet

110
04:26.010 --> 04:27.210 align:middle line:84%
Associate study.

111
04:27.210 --> 04:29.310 align:middle line:90%
Right here on lines
three and four,

112
04:29.310 --> 04:32.430 align:middle line:90%
you can see I've got the
fully qualified domain
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
04:29.310 --> 04:32.430 align:middle line:90%
you can see I've got the
fully qualified domain

113
04:32.430 --> 04:34.680 align:middle line:90%
name, the port that
it's listening on,

114
04:34.680 --> 04:36.640 align:middle line:84%
the username, and the password.

115
04:36.640 --> 04:38.577 align:middle line:90%
And this document is
publicly available.

116
04:38.577 --> 04:40.410 align:middle line:90%
Now I know you're like,
whoa, wait a minute.

117
04:40.410 --> 04:41.380 align:middle line:84%
Don't do that.

118
04:41.380 --> 04:44.870 align:middle line:90%
This resource is actually
deployed publicly available.

119
04:44.870 --> 04:47.460 align:middle line:90%
Cisco has put this device
out there so that anyone

120
04:47.460 --> 04:48.790 align:middle line:84%
can log into it and use it.

121
04:48.790 --> 04:51.450 align:middle line:90%
So I'm not breaking any routes
or anything by doing this.

122
04:51.450 --> 04:54.540 align:middle line:90%
But the gist of it is
this is a big no-no.

123
04:54.540 --> 04:55.440 align:middle line:84%
Don't do this.

124
04:55.440 --> 04:57.870 align:middle line:90%
Don't hard code your
usernames and passwords

125
04:57.870 --> 05:00.370 align:middle line:90%
under any circumstance
in your code.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
04:57.870 --> 05:00.370 align:middle line:90%
under any circumstance
in your code.

126
05:00.370 --> 05:02.563 align:middle line:90%
And don't publish that
code on top of that.

127
05:02.563 --> 05:04.480 align:middle line:90%
There are different
things that you could use.

128
05:04.480 --> 05:07.930 align:middle line:90%
First of all, you should
use some form of key vault,

129
05:07.930 --> 05:10.570 align:middle line:90%
like Azure Key Vault.
This is a secure way where

130
05:10.570 --> 05:13.990 align:middle line:90%
your application would have
to log in to the key vault,

131
05:13.990 --> 05:16.300 align:middle line:90%
and then once it's
been authenticated,

132
05:16.300 --> 05:18.400 align:middle line:90%
it can then return
the password that it

133
05:18.400 --> 05:20.860 align:middle line:90%
should use for something
like a database, or something

134
05:20.860 --> 05:22.270 align:middle line:84%
like an application server.

135
05:22.270 --> 05:25.610 align:middle line:90%
But if you don't have access to
this, in a worst case scenario,

136
05:25.610 --> 05:27.340 align:middle line:90%
you could at least
tell your code

137
05:27.340 --> 05:30.130 align:middle line:90%
to retrieve something like
an environment variable out
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
05:27.340 --> 05:30.130 align:middle line:90%
to retrieve something like
an environment variable out

138
05:30.130 --> 05:31.760 align:middle line:84%
of the server that it's on.

139
05:31.760 --> 05:34.240 align:middle line:90%
So you could put your password
in an environment variable

140
05:34.240 --> 05:35.110 align:middle line:84%
in the server.

141
05:35.110 --> 05:37.390 align:middle line:90%
That way when you publish
your code to get GitHub,

142
05:37.390 --> 05:39.190 align:middle line:90%
you're not publishing
the password.

143
05:39.190 --> 05:42.640 align:middle line:90%
All you're doing is publishing
that the password must come

144
05:42.640 --> 05:44.300 align:middle line:84%
from an environment variable.

145
05:44.300 --> 05:47.170 align:middle line:90%
The hacker would then have
to gain access to the server

146
05:47.170 --> 05:49.710 align:middle line:90%
and explore the environment
variables to find the password.

147
05:49.710 --> 05:52.510 align:middle line:90%
So again, this is not
the best case scenario.

148
05:52.510 --> 05:54.610 align:middle line:90%
You don't want to use
environment variables.

149
05:54.610 --> 05:56.950 align:middle line:90%
You want to use some sort
of resource, or tool,

150
05:56.950 --> 05:58.730 align:middle line:90%
or application,
like a key vault.

151
05:58.730 --> 06:02.110 align:middle line:90%
But if you absolutely do not
have access to those resources,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

151
05:58.730 --> 06:02.110 align:middle line:90%
But if you absolutely do not
have access to those resources,

152
06:02.110 --> 06:04.170 align:middle line:90%
the worst thing you
could do is hard

153
06:04.170 --> 06:06.970 align:middle line:90%
code a username and password and
then share it with the world.

154
06:06.970 --> 06:09.610 align:middle line:90%
Now the last thing, especially
is a network administrator

155
06:09.610 --> 06:12.820 align:middle line:90%
that you have to keep in
mind, is default user names

156
06:12.820 --> 06:13.528 align:middle line:84%
and password.

157
06:13.528 --> 06:15.820 align:middle line:90%
There is an OK chance that
at some point in our career,

158
06:15.820 --> 06:18.760 align:middle line:90%
we've tried to log into
our own home router,

159
06:18.760 --> 06:21.040 align:middle line:90%
like a Linksys device,
or Netgear device,

160
06:21.040 --> 06:22.132 align:middle line:84%
or an Asus device.

161
06:22.132 --> 06:23.590 align:middle line:90%
And that's great
because, you know,

162
06:23.590 --> 06:25.960 align:middle line:90%
we're networking professionals
and this is kind of our jam.

163
06:25.960 --> 06:27.220 align:middle line:84%
We want to log in and see it.

164
06:27.220 --> 06:28.095 align:middle line:84%
But here's the thing.

165
06:28.095 --> 06:30.250 align:middle line:90%
These devices like
this, when you buy them
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

165
06:28.095 --> 06:30.250 align:middle line:90%
These devices like
this, when you buy them

166
06:30.250 --> 06:32.620 align:middle line:90%
off the shelf at a retailer
like Best Buy or something

167
06:32.620 --> 06:36.400 align:middle line:90%
like that, the average end user
is just going to plug it in

168
06:36.400 --> 06:37.990 align:middle line:84%
and it's just going to work.

169
06:37.990 --> 06:40.660 align:middle line:90%
And they're never, ever going
to log into this device.

170
06:40.660 --> 06:42.790 align:middle line:90%
Beyond that, when they
log into this device,

171
06:42.790 --> 06:45.550 align:middle line:90%
there's an OK chance
that it won't prompt them

172
06:45.550 --> 06:47.390 align:middle line:84%
to change the default password.

173
06:47.390 --> 06:49.420 align:middle line:90%
So this device
will forever remain

174
06:49.420 --> 06:52.630 align:middle line:90%
with a user name of admin
and a password of admin

175
06:52.630 --> 06:56.110 align:middle line:90%
So any hacker who attempts
to attach to that network,

176
06:56.110 --> 06:59.140 align:middle line:90%
maybe they're driving by,
an attack called wardriving,

177
06:59.140 --> 07:00.790 align:middle line:90%
where they're driving
by their house
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

177
06:59.140 --> 07:00.790 align:middle line:90%
where they're driving
by their house

178
07:00.790 --> 07:03.310 align:middle line:90%
and they see a
wireless access signal,

179
07:03.310 --> 07:06.220 align:middle line:90%
they could temporarily,
potentially connect to it

180
07:06.220 --> 07:09.730 align:middle line:90%
and then immediately get in
to the network device itself.

181
07:09.730 --> 07:11.240 align:middle line:84%
Now that's in home networking.

182
07:11.240 --> 07:14.320 align:middle line:90%
Obviously, the same goes for
business networking, too.

183
07:14.320 --> 07:17.020 align:middle line:90%
You never want to use
default passwords anywhere.

184
07:17.020 --> 07:21.310 align:middle line:90%
And not just on network devices,
but on servers, IoT devices,

185
07:21.310 --> 07:25.090 align:middle line:90%
even your battery backups,
like UPSes that have NIC cards.

186
07:25.090 --> 07:27.620 align:middle line:90%
You don't want them to use
the default credentials there.

187
07:27.620 --> 07:29.890 align:middle line:90%
So password protection
is a little bit more

188
07:29.890 --> 07:32.170 align:middle line:90%
than just setting a
complicated password.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

188
07:29.890 --> 07:32.170 align:middle line:90%
than just setting a
complicated password.

189
07:32.170 --> 07:33.748 align:middle line:90%
You also have to
keep in wherever

190
07:33.748 --> 07:36.040 align:middle line:90%
your default passwords may
be used in your environment.

191
07:36.040 --> 07:37.920 align:middle line:90%
We need to update
that right away.

192
07:37.920 --> 07:40.480 align:middle line:90%
And we also need to talk to
our security and application

193
07:40.480 --> 07:43.330 align:middle line:90%
developers, and talk to them
about, how are you actually

194
07:43.330 --> 07:46.490 align:middle line:90%
storing the credentials that the
application is going to need?

195
07:46.490 --> 07:47.630 align:middle line:84%
That's important, too.

196
07:47.630 --> 07:49.900 align:middle line:90%
So that's been understanding
password attacks.

197
07:49.900 --> 07:51.610 align:middle line:90%
I hope this has been
informative for you.

198
07:51.610 --> 07:53.970 align:middle line:90%
And I'd like to thank
you for viewing.