Steve Riley on Security

Browse by Tags

Passgen tool from my book: Way back in 2005, Jesper Johannson and I wrote Protect Your Windows Network . It’s still available , and although its product set is now somewhat dated (Windows XP and Server 2003), much of the practical advice about security policies, social engineering, Read More...
Posted 29 September 08 01:42 by Steve Riley | 14 Comments
Filed under passwords, my book
Password policies. Once again.: Recently in the newsgroups ( news:microsoft.public.security , to be specific) the question of password polices and the out-of-box defaults came up. The poster lamented a number of things: that Microsoft doesn't enable account lockout by default, that Read More...
Posted 04 September 07 03:14 by Steve Riley | 21 Comments
Filed under authentication, security policies, passwords
Why administrative passwords will never be like nuclear missile launchers: During the past few months many people have lamented that Windows lacks a nuclear missile style control option for administrator passwords. Surely you've read about or seen photographs of missile silos where two operators, separated by a distance greater Read More...
Posted 21 November 06 02:16 by Steve Riley | 11 Comments
Filed under authentication, security policies, risk mitigation, passwords, security science, Active Directory, physical security
Security myths and passwords: I like this a lot. http://www.cerias.purdue.edu/weblogs/spaf/general/post-30/ In the practice of security we have accumulated a number of “rules of thumb” that many people accept without careful consideration. Some of these get included in policies, and Read More...
Posted 30 April 06 09:07 by Steve Riley | 3 Comments
Filed under identity, authentication, security policies, passwords, security myths
What do YOU need out of two-factor authentication?: Two-factor authentication continues to grow in popularity and emerge as a security requirement for many people I meet with. At Microsoft, we use smartcards internally for VPN access right now; soon we'll be requiring smartcards for domain logon, too. Read More...
Posted 20 April 06 03:37 by Steve Riley | 43 Comments
Filed under identity, authentication, biometrics, email, access technologies, security policies, risk mitigation, passwords
It's me, and here's my proof: why identity and authentication must remain distinct: My February Security Management column is posted: http://www.microsoft.com/technet/community/columns/secmgmt/sm0206.mspx No matter what kinds of technological or procedural advancements occur, certain principles of computer science will remain -- especially Read More...
Posted 16 February 06 09:41 by Steve Riley | 7 Comments
Filed under identity, authentication, biometrics, security policies, risk mitigation, passwords, security science