Measuring the corporate password policy: a weak-password audit
You plan an approved, privacy-preserving password-quality audit; in the lab domain you measure empty, shared, breached and never-changed passwords and patterns, audit how Linux and applications store passwords, improve things with a banned list and stricter policy, and measure again.
Level 301 · 18 lessons · 15 practice labs
Lessons
Planning the audit
- The purpose of a password audit: measuring the policy, not the person
- Approval, privacy and who sees the results
- Storing and destroying audit data safely
- Short task: prepare an approval document for the password audit
Measuring
- Password-quality audit tools: measuring without taking data off the system
- Password-quality checks: empty, identical, breached and never-changed passwords
- Detecting passwords shared across accounts
- Studying password patterns with statistics: seasons, years, company name
- Auditing password hash algorithms on Linux servers
- Auditing how applications store passwords
- Short task: measure the lab directory’s password quality and produce summary statistics
Improving
- Deploying a banned-password list in the domain
- A stricter password policy for privileged accounts
- Steering weak accounts to a reset, and communication
- User awareness: explaining without blaming
- Short task: deploy the banned list and repeat the measurement
Report
- The password audit report: statistics, risk and recommendations
- Capstone: measure, improve and report on a fictional organisation’s password policy
Practice labs
- Prepare a consent form for a password audit: Prepare a consent form for Yelkovan Bankası's lab domain stating scope, purpose and who will see the results.
- Write the storage and destruction plan for audit data: Decide where, for how long and with which encryption the hash dump is kept, then carry out and evidence its destruction in the lab.
- Fix an audit plan with a flawed scope: Review an audit plan that targets individuals, exports data and lacks consent, list the issues and turn it into a plan that measures policy.
- Count empty passwords and passwords equal to the username: Count accounts with empty or username-equal passwords in the lab domain without exporting data and write summary statistics.
- Find passwords that never changed or never expire: Measure last password change dates in the lab directory and list accounts unchanged for years or flagged never-expire, with reasons.
- Measure the breached-password rate in the domain: Compare the lab domain's hashes locally with a breach list and report the rate per department without naming people.
- Count passwords shared across accounts: Find groups of accounts with identical hashes in the lab directory and record how many accounts share a password.
- Detect admins reusing their normal account's password: Measure password reuse between privileged accounts and the same person's normal account and report the finding with its risk.
- Analyse password patterns statistically: Derive the distribution of season, year, company name and trailing-digit patterns from the audit results and prepare a summary with charts for Demirsu Enerji.
- Audit password hash algorithms on Linux servers: Check the hash algorithm and default setting on three lab Linux servers and record the outdated ones in the report.
- Upgrade the old algorithm and verify with new passwords: Switch the server still on an old algorithm to a strong default and show with a test account that new hashes are created correctly.
- Audit an application's password storage method: Inspect the lab app's source and database to determine its storage method, fix the gaps and verify again.
- Enforce a banned password list in the domain: Add a banned-list filter to the lab domain and verify a listed password is rejected on change.
- Apply a stricter password policy to privileged accounts: Define a fine-grained password policy for the admin group and verify it applies to admins without affecting normal users.
- Measure, improve and report on the password policy: Measure Lavinya Klinikleri's lab directory, apply improvements, measure again and write a blame-free management report.
About this course
You plan an approved, privacy-preserving password-quality audit; in the lab domain you measure empty, shared, breached and never-changed passwords and patterns, audit how Linux and applications store passwords, improve things with a banned list and stricter policy, and measure again.
What you will learn
- Planning the audit
- Measuring
- Improving
- Report
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.