Software

Ask something
Discussion Locked

Password Security

0 helpful
12 replies

by hcetrepus

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I work in education at a career and technology school. Many users pass around their passwords freely, have them written down in obvious places (under the keyboard) in case they forget them. Many more think that we have some kind of master list and should be able to look them up at their convenience.

The point: At a recent meeting with a department head, I mentioned that some workorders require the user to be present in order to log in for us. With a look of incredulity she said " surely you have a master list with everyones passwords?" (This dept head REQUIRES folks in her dept to give her their password) No, we don't. As per our Netwoork adminsitrator, we never ask for a password, always for someone to log in for us. Are we alone, or being unrealistic? Is this something we *should* be doing?

12 replies

by synner

You guys have violated every security best practice. How can you provide data confidentiality, integrity, availability? As an education institution, if the environment is as you described, I'm fairly certain it's violating some of the recent legislations regarding confidentiality and privacy.

by hcetrepus

If not, could you please point out the areas in which have "violated every security best practice"?

by Former member

Naturally, it's the stupidest, most ignorant thing I've ever heard. But realistically, what kind of information are we talking about here? Is there private information involved? Then we're talking now about violating legislation such as GLB. If there's really no private info here, I suppose they could get away with it. One has to ask oneself though what the purpose would be behind having individual ID in the first place. Seems to me though that there's a reason people have their own idea: For personal/private data access. So I'd start working on straightening out these people beginning with legislative requirements. Start making a data security policy.

by hcetrepus

For a constructive reply. Part of my post/question was done as devils advocate, and this is what I was looking for.

by the scummy one

This falls under training users AND managers.
Managers should not be keeping PW lists of their employees, teachers should not keep PW lists of students, etc..

There are times where asking for the PW may be acceptable, but keeping PW lists is bad practice altogether.
You should write up a PW policy, and pass it up the chain for approval. Then, send it to everyone involved.

by hcetrepus

Thank you. Can you explain WHY teachers shouldn't havce a password list of their students?

by the scummy one

and many people, not just teachers, may not use the best security practices with others PWs.

The students are in school, they are there to learn. If they cannot even remember a PW then there should be consequences. Once they join the workforce, they will likely need to practice security and know how to handle PWs anyway, so they should learn it sooner.

Nobody should have PW lists for other people.

by jdclyde

Everytime a user calls to have a password reset, their department gets charged $20 and is labeled "Reset password for user (insert name)".

As for sharing of passwords, all users are required to sign an "Acceptable computer use" agreement before they get access to anything, or any computer equipment. It is clearly stated that they are not to ever use anyone else's password, nor are they to share theirs with anyone. If either happens, both accounts are instantly locked until a manager contacts us to have new accounts setup, which is a $50 charge per account.

It is about accountability. What if someone does something illegal? You can't show who did what if it is well known that all the users know everyone elses passwords.

We NEVER know someones password, so if something happens, they can't drop it on our lap as being able to have done XYZ with their accounts.

Any manager that would require the password list is a micromanaging twit that should be canned ASAP.

by hcetrepus

We NEVER know someones password, so if something happens, they can't drop it on our lap as being able to have done XYZ with their accounts.

This is my Network Admin and mines thinking exactly.

Any manager that would require the password list is a micromanaging twit that should be canned ASAP.

I love ya man~!

by nonapeptide

...by that I mean, what industry is it and how big is the office? Ignore me if you don't want to divulge that type of info (nothing specific, just "manufacturing / 250-500 users" would be helpful) I can think of more places that would pop a cork if there were fees for such things than would view it as beneficial. Mind you, It might not be a bad idea where I work. Account sharing is the norm, especially since alot of people that are related to eachother (by blood or law) work together there. Off the top of my head, I can think of a few of my user's passwords. It makes it easy to perform some maintenance, however, there is a downside (as has already been mentioned, but I'll reiterate it for good measure):

If I don't know someone's password, I can't be brought into the circle of suspicion if something bad happens to their user account.

Just curious, doesn't fining people for account resets encourage the old password-written-on-a-sticky-note-and-put-under-the-desk-phone routine?

by robo_dev

So if user A uses user B's password to download the nastiest illegal porno-virus-worm that takes out all your databases, who get's fired? User A or user B?

I can think of dozens of reasons that this coule cause problems....sabotage, snooping on PCs, users getting other users fired, etc, etc.

How does this departmental head store the list? (let me guess, top right desk drawer and a document on the LAN entitled "Password List 2008.doc ).

An employee doing something fraudulent, making threats, or posting derogatory comments to a message board is surely going to use someone elses ID.

If your organization does not require any personal accountability for computer use, then the password list idea is fine.

If there are rules of any sort, a password list removes all audit trail and control with respect to enforcement of those rules.

by synner

What is the use of a password if your organization has that attitude about passwords? Why have it? Just leave everything open.

This discussion is closed to new replies.