📘 CCNA 200-301 v1.1

5.4 Describe security password policy elements, such as management, complexity, and password alternatives (multifactor authentication, certificates, and biometrics)

Overview

In any IT environment, protecting access to devices, systems, and networks is extremely important.
One of the first layers of security is password protection.

This topic explains how passwords should be:

• Created and managed properly (management)
• Made strong and hard to guess (complexity)
• Supported with stronger methods like multi-factor authentication (MFA), digital certificates, or biometrics (password alternatives).

---

🔹 1. Password Management

Password management means creating, storing, and maintaining passwords in a secure way across network devices and user accounts.

In a network environment, this applies to:

• Router and switch login passwords (console, VTY/SSH, enable passwords)
• User account passwords in operating systems
• Administrator passwords on servers or management systems

✅ Key Password Management Best Practices:

1. Change default passwords
   • All network devices (routers, switches, firewalls) come with default credentials (like “admin/admin”).
   • These should always be changed immediately during setup.
2. Use unique passwords for each device or account
   • Don’t use the same password everywhere.
   • If one device is compromised, others should stay protected.
3. Change passwords regularly
   • Periodic password changes help prevent long-term unauthorized access.
   • Organizations often set a password expiration period (e.g., every 90 days).
4. Restrict password reuse
   • Users shouldn’t be able to reuse their previous few passwords.
5. Store passwords securely
   • Never write them in plain text.
   • Use encrypted storage or password management systems (like Cisco’s service password-encryption command).
6. Use role-based access
   • Only authorized personnel should have administrative-level passwords.
   • Different roles can have different privilege levels (for example, Cisco’s privilege levels 1–15).
7. Audit password usage
   • Regularly review who has access to what, and whether passwords meet policy standards.

---

🔹 2. Password Complexity

Password complexity means making passwords hard to guess or crack by using a mix of different characters and sufficient length.

✅ Password Complexity Rules

To make a strong password:

• Minimum length: At least 8 characters (many organizations require 10–12 or more).
• Character mix: Include:
  • Uppercase letters (A–Z)
  • Lowercase letters (a–z)
  • Numbers (0–9)
  • Special characters (!, @, #, $, %, etc.)
• Avoid predictable patterns:
  • No common words like “password” or “admin123”.
  • No personal information (like usernames or device names).

🔐 On Cisco Devices:

Cisco devices allow you to set password complexity requirements and encryption.

For example:

• service password-encryption → Encrypts passwords in the configuration file.
• enable secret → Creates a hashed (strongly encrypted) password for privileged mode.
• username admin secret StrongPa55! → Uses a secure password for a local user.

✅ Why Password Complexity Matters

• Simple passwords are easy for hackers to guess using brute force or dictionary attacks.
• Complex passwords make such attacks take much longer or become impractical.

---

🔹 3. Password Alternatives

Passwords alone are not always enough to secure systems.
Hackers can still steal or guess passwords, so we use additional authentication methods.

The main password alternatives are:

1️⃣ Multifactor Authentication (MFA)

MFA requires users to prove their identity using two or more factors from different categories:

Factor Type	Example	Description
Something you know	Password or PIN	User’s knowledge
Something you have	Security token, smartphone app, smart card	Physical item user possesses
Something you are	Fingerprint, facial recognition, iris scan	User’s biological feature

✅ Example in an IT environment:

• Logging into a network management system might require:
  1. Password (something you know)
  2. One-time code sent to your mobile (something you have)

This prevents unauthorized access even if someone steals your password.

---

2️⃣ Digital Certificates

A digital certificate is an electronic credential used to prove the identity of a user, device, or system.

• It uses Public Key Infrastructure (PKI).
• Each certificate contains:
  • A public key
  • Information about the user/device
  • A digital signature from a trusted Certificate Authority (CA)

✅ How it works:

• Instead of typing a password, a system can verify a certificate to authenticate a user or device.
• Cisco routers, VPNs, and wireless networks can use certificate-based authentication.

✅ Benefits:

• Certificates are much harder to steal or fake.
• They can expire and be revoked for security control.

---

3️⃣ Biometrics

Biometric authentication uses unique physical characteristics of a person to verify identity.

Common types:

• Fingerprint scanning
• Facial recognition
• Iris or retina scanning
• Voice recognition

✅ Where used:

• In secure IT environments like data centers or admin workstations.
• Often combined with passwords or smart cards for MFA.

✅ Benefits:

• Cannot be easily shared or guessed.
• Provides very strong proof of identity.

✅ Limitations:

• Requires special hardware (scanners, cameras).
• Privacy and data storage must be managed securely.

---

🔹 4. Summary Table

Element	Purpose	Key Points
Password Management	Control how passwords are created, stored, and updated	Change defaults, use unique passwords, change periodically, restrict reuse
Password Complexity	Make passwords harder to guess	Use long, mixed-character passwords, avoid simple or common words
MFA (Multifactor Authentication)	Add extra layers of security	Combine password with token or biometric
Certificates	Authenticate using digital credentials	Use PKI and trusted Certificate Authorities
Biometrics	Authenticate using unique human traits	Fingerprint, face, iris, or voice verification

---

🔹 5. In Cisco Environment (Exam-Relevant)

In Cisco IOS, you may encounter these commands related to password security:

Command	Description
enable secret [password]	Sets encrypted password for privileged EXEC mode
service password-encryption	Encrypts all plain text passwords in the configuration
username [name] secret [password]	Creates a local user with encrypted password
login block-for [seconds] attempts [number] within [seconds]	Blocks login attempts after repeated failures (helps prevent brute-force attacks)
security passwords min-length [length]	Sets minimum password length
aaa new-model	Enables AAA framework (used for MFA and centralized authentication)

---

✅ Key Points to Remember for the CCNA Exam

• Understand the difference between password management, complexity, and alternatives.
• Know the basic Cisco IOS commands for password security.
• Recognize MFA, certificates, and biometrics as password alternatives.
• Be able to explain why password policies are important for network security.

---