Here's another free webcast from Rapid7, home of Metasploit and Nexpose, that I thought might be a great help when securing your own environment as well as talking to the higher ups. Good luck with that one. 


Reserve your spot now - space is limited
http://information.rapid7.com/Webcast-lessonslearned-breaches-registration.html?LS=1152784&CS=eh


Enjoy,
Don

Here's the lesson: use bcrypt.

The reason the LinkedIn hack resulted in so much criticism is that the passwords were all hashed without any sort of password stretching or salting.  Salting prevents precomputation and forces the attacker to guess each password separately; brute force can't scale for multiple users.  Stretching also destroys rainbow tables and makes brute force much slower.  Some people have criticized LinkedIn for using SHA-1 but that's beside the point.  With salting and stretching, even MD5 would be fine (although I'd use SHA-256 or better).

Nobody should design their own scheme here.  Salting and stretching are already implemented in bcrypt, scrypt, and PBKDF2.  Use one of those.  Scrypt is new, but bcrypt has been in OpenBSD for more than a decade and is pretty widely supported.  PBKDF2 is standardized in RSA's PKCS #5 and in RFC 2898.  Bcrypt and Scrypt appear to be the strongest options.