[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 4 · 4.2.d
AP Cybersecurity · Securing Devices
Configuring Login Settings
Five settings, three jobs: shape the password, age it, and slow the attacker down.
key ideaFive settings, four attacks. Length does the most work; lockout is what stops the online attack outright.
Matching controls to threats
These are technical controls configured once and enforced on everyone. Each answers a specific attack from earlier in this unit, and the one that matters most makes guessing arithmetically hopeless.
| Setting | What it enforces | Attack it answers |
|---|
| minimum password length | at least a certain number of characters | guessing — longer and more complex means harder to guess |
| complexity | at least one character from each character set | guessing, by enlarging the alphabet |
| maximum password age | a prompt to change after a set number of days | a leaked but unnoticed credential remaining valid indefinitely |
| password history | storing a number of previous passwords, blocking reuse | users cycling back to a favorite password |
| account lockout | a lockout period after N invalid attempts | continuous online guessing |
Only the last row stops an attack outright. The first four raise the cost of guessing; lockout removes the attacker’s ability to keep trying.
Layering
The top two shape what a password is; the middle two shape how long it lasts; the last shapes how fast it can be attacked. Three different jobs, often mistaken for one.| Lockout threshold | Effect on adversaries | Effect on users |
|---|
3 attempts | stops guessing quickly | frequent lockouts from ordinary typos |
5–10 attempts | still stops automated guessing | tolerable for genuine mistakes |
50 attempts | allows a dictionary run | users never notice it |
| no lockout | unlimited online attempts | no friction at all |
The middle row is the usual compromise. A threshold so low that users are constantly locked out generates pressure to remove the control entirely — which is the worst outcome of the four.
Shape itlength + complexity
Age itmaximum age + history
Slow itlockout after N attempts
how the five relate
- Length enlarges the search space fastest — the CED notes longer and more complex passwords are harder to guess.
- Complexity requires a character from each character set, which users satisfy in predictable places.
- History is what makes maximum age meaningful — without it, users alternate between two passwords.
- Lockout is the setting that defeats continuous guessing at the portal.
Worked analysis
EX 1
Length against complexity
An administrator must choose between raising the minimum length from 8 to 14, or adding a fourth character-set requirement. Which does more?
1
State what complexity adds
A larger alphabet per character position.
2
State what length adds
More positions — which multiplies the space far faster than enlarging the alphabet does.
3
Note the human factor
Users satisfy complexity rules in predictable places — capital first, digits last.
4
Choose
Raise the minimum length.
5
Add the practical companion
A password manager or passphrases, so a longer requirement does not push users toward writing them down.
EX 2
Why history matters
A policy requires a change every 90 days but stores no password history. What happens?
1
Predict user behavior
They alternate between two passwords, or append an incrementing digit.
2
State the consequence
The credential is effectively unchanged, so a leaked password stays valid.
3
Name the missing setting
Password history — storing a number of previous passwords to prevent reuse.
4
Note how many to store
Enough that cycling is impractical; many organizations store 10 or more.
5
State the pairing
Maximum age without history is a change requirement that changes nothing.
EX 3
Setting a lockout threshold
A help desk reports constant lockouts at 3 attempts and asks for the control to be removed. Advise.
1
Take the complaint seriously
Ordinary typos should not lock people out several times a week.
2
Reject the proposed fix
Removing lockout permits continuous online guessing — the attack it exists to stop.
3
Adjust the threshold
Raise it to 5–10, which still stops automated guessing.
4
Adjust the duration
A short automatic lockout frustrates automation while barely inconveniencing a person.
5
State the principle
A control users campaign to remove is mis-tuned, not wrong. Tune it before losing it.
Check yourself
What does a complexity requirement enforce?
Show answer
That users setting a new password must include at least one character from each character set.
Why does minimum length matter?
Show answer
Users must have at least a certain number of characters, and the longer and more complex a password is, the harder it is to guess.
What do maximum password age and password history do together?
Show answer
Maximum age prompts a change a set number of days after the last one. Password history stores a number of previous passwords so a user cannot reuse them — without it, users simply cycle back.
What does an account lockout setting prevent?
Show answer
An adversary continuously attempting wrong passwords at the login portal. After a set number of invalid attempts, the account locks for a period.