Extension Documentation

Authentication Policies
Prev Chapter 9. Future considerations Next

Authentication Policies

One major part of the Password Control Component is the implementation of site authentication polices. An authentication policy should consist of a number of items:

  1. A proper password ageing policies should be in place to naturally take care of old or unused accounts. The idea behind password ageing is that after a certain amount of time, a password expires. A password is less prone to compromise if it is changed frequently. Likewise, if an account is compromised, its usefulness will be limited to the amount of time left before the expiry timer concludes. Ageing account passwords can reduce exposure if brute-force, social engineering, or sniffing attempts are successful.

  2. The password strength is extremely important. It is imperative that the systems requiring users to change their passwords also enforce some level of strictness with regards to what passwords are accepted. An unguessable password makes brute-force attacks 'the premiere method by which accounts are compromised' mostly futile. An exhaustive brute-force attack will eventually discover all passwords, given enough time, but the idea is to use a password of sufficient length, so that it cannot be guessed in a reasonable amount of attempts. The successful guessing attempts normally find extremely trivial passwords, such as ones that are the same as the user name.

  3. Account ageing, that is the disabling of unused accounts, is another factor. Unused accounts are probably the second most commonly compromised. If you do not have a password ageing policy, at least be certain to disable old or unused accounts.

  4. There are different ways to implement password ageing. The ageing of a password should naturally disable unused accounts. Since a user must login to be given notice that their password has expired, and if they fail to do so within a certain amount of time, the account itself can be disabled. Some of these things can be achieved with products such as Windows Active Directory and various Unix-based LDAP servers support the setting of password policies such as LDAP. It is however extremely unlikely that the majority of Joomla systems available upon the web make use of these types of systems. For that reason it is important that there is some form of control within Joomla itself. [Joomla authentication plug-ins can be used to make the necessary connections to the third party products such as LDAP if the need exists.]

  5. The Password Control Component is intended to implement some form of authentication policies. This would enable a site to have different policies for different groups of users

Prev Up Next
Chapter 9. Future considerations Home Password Guidelines
Go To Top

Joomla! Debug Console

Session

Profile Information

Memory Usage

Database Queries