Forbes: Keep Austin Weird, But Use Good Password Controls

After an ex-employee at an Austin car dealership gained unauthorized access to a website that allowed him to activate a lock-out device on more than 100 cars, Richard Stiennon reminds readers about how critical access controls are.

“The lesson learned is simple. Do not ever provide a service over the web that controls something critical (house lights, surveillance cameras, bank accounts, car lock-out devices, street signs, traffic lights, bank accounts, stock trading accounts, etc.) without having at least rudimentary controls in place.”

He suggests three basic controls:
1. Lock out after four failed login attempts.
2. Require CAPTCHAS.
3. Use two-factor authentication (like that provided by PhoneFactor).

Read the full post at http://blogs.forbes.com/firewall/2010/03/18/keep-austin-weird-but-use-good-password-controls