Introduction to password security: policy, strength and multi-factor authentication
You learn why passwords are the weak link and what strength and entropy mean; you write a password policy based on current guidance, block breached passwords and apply multi-factor authentication to lab accounts.
Level 101 · 13 lessons · 12 practice labs
Lessons
Why passwords are the weak link
- Authentication: something you know, have and are
- Why passwords stay weak: reuse, predictability and breaches
- Password strength and entropy: why length beats complexity
- Short task: calculate and rank the strength of ten passwords
A good policy
- Current password guidance: what NIST SP 800-63B says
- Passphrases and password managers
- Checking against breached-password lists
- Introduction to account lockout and rate limits
- Short task: write a password policy for a small company
Beyond the password
- Types of multi-factor authentication: SMS, app, hardware key
- Phishing-resistant authentication: FIDO2 and passkeys
- The security of password reset flows
- Capstone: apply and test a password policy and multi-factor authentication on lab accounts
Practice labs
- Score and rank ten passwords by strength: Calculate the entropy of ten sample passwords in the lab and produce a table ranked from weakest to strongest.
- Length or complexity: the Gelincik Okulları case: Measure Gelincik Okulları's two candidate rules on the same password set and show which one yields stronger passwords.
- Measure and fix a passphrase generator's settings: Work out the real entropy of the lab's passphrase generator from its word list and word count, and fix the setting if it falls below the target.
- Compare an old password policy with current guidance: Mark Tarçınlı Fırın's policy, which forces a change every 90 days, item by item against current guidance and list the problem clauses.
- Write a password policy for a small company: Write a one-page policy for Kumsal Turizm covering length, a banned list, lockout and multi-factor authentication.
- Enforce the password policy on lab accounts and verify it: Enforce your policy on the lab server with the password quality module and prove that three non-compliant passwords are rejected.
- Check lab account passwords against a breach list: Use the lab's breached-password hash list to count which lab accounts use a leaked password and write a report line.
- Set up a banned list that blocks breached passwords: Add the breached-password list to the lab server as a banned list and verify a listed password can no longer be chosen.
- Design a breach check that never sends the password out: Design a breach-check flow for Narçiçeği Eczaneleri that uses only a hash prefix and test it with the lab's sample data.
- Add time-based one-time codes to a lab account: Enable an app-based second factor on a lab server account and verify that a login without the code is refused.
- Find the weak points in this password reset flow: Find the gaps in the lab app's reset flow around link lifetime, single use and notification, and report them with fixes.
- Apply and test the password policy together with MFA: Roll out the policy and the second factor together on lab accounts, run five test scenarios and record the results.
About this course
You learn why passwords are the weak link and what strength and entropy mean; you write a password policy based on current guidance, block breached passwords and apply multi-factor authentication to lab accounts.
What you will learn
- Why passwords are the weak link
- A good policy
- Beyond the password
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.