Dan Jones is the new CIO of Ricochet Systems, an Internet securities broker. After assessing the e-commerce risks in his company, he determines that passwords are a weak link that needs additional protection. However, he is unsure as to what the requirements for a robust password are. At your monthly golf outing, Dan asks you—knowing your background in computer forensics—what checks and policies should be in place on passwords in his company.
1. How often should passwords be changed?
2. What requirements should be enforced on passwords chosen by employees (length, dictionary words, etc.)?
3. Are there alternatives to passwords that Dan should investigate?
You tell Dan you’ll send him a detailed e-mail message answering these questions when you get back to work. Write this message giving Dan advice on his password policies.