Skip to main content

Posts

Showing posts from November, 2008

Welcome to Mark Baggett - In Depth Defense

I am the course Author of SANS SEC573 Automating Information Security with Python. Check back frequently for updated tools and articles related to course material.




Worst cognitive password?

Cognitive passwords are those questions your bank and other accounts have you setup so that you can reset your password or verify your identity if you have forgotten your password.   I personally am not a big fan of these.   If forced to implement a solution based on these I would go with several "In the Wallet" questions.   Questions that would require the individual pull something from there wallet to answer the question.   Things like:"What are the last 6 digits of your library card number?"  "What is the last name of the issuer of your fitness club card?"  "What is the last 6 digits on your favorite Shopping club card?" If you use these types of questions you have to give the user many choices.   Not everyone has a shopping club card  or a library card, so a broad set of questions works best.   The goal of coming up with the questions should be to have answers that can not be easily guessed or looked up on the internet.   Here are some examples…