Smartening up our password discipline

[Gavin Clarke]

Our users are getting increasingly undisciplined with their passwords.

Does anyone know of any major catastrophies that have occurred as a result of this sort of behaviour please.

I'm looking to give them a short sharp shock. Perhaps some of them will respect the systems a little better if I can.

Thanks in advance for all information.

[Rita C Workman]

Well, maybe you could tighten up things.

Take a look at man security, and see if anything jumps out at you.....like what you can do with the ~security file for passwords.

Just something small...

Rgrds,
Rita

[Pete Randall]

Note that many of the features described in man security require conversion to a trusted system!


Pete

[Gavin Clarke]

Thanks very much for your answers.

They are trusted systems.

The users write passwords down, share passwords, that sort of discipline. Unfortunately there are some pretty high up people who support this or at least don't discourage it.

One day something bad will happen and then I'll be the one trying to tidy up the mess. This is not something I want, so I'm asking for help.

I'm trying to get them to appreciate what they've got before it's too late.

[Steven E. Protter]

There is a file called /etc/default/security

In that file on a trusted system you can set password length, complexity and reuse requirements(how many passwords before re-use) and how many minimum numeric digits and such.

SEP

[Gavin Clarke]

Thankyou.

I am happy with the way the passwords are set up (I used SAM).
I am not happy with what people do with them.

Unfortunately there doesn't seem to be a file where you can configure people's mindset.

[Kent Ostby]

Gavin --

As more of a user than an administrator, you raise a point about passwords that I feel strongly about.

Namely, that MOST password "discipline" that administrators put into the system actually causes WORSE password management because (for instance with my work), I can't use the last five passwords I've used.

Now I wont write them down, but I can see where someone who has used all their "easy to remember" passwords is going to start getting irritated. They don't remember passwords for a living they are accountants or architects.

What I would suggest to you is to teach a brownbag on how to come up with easy to remember passwords.

The best example I've been given is to teach people to use something like the first letters of each of the words in a favorite line from a song or a movie.

So if you really like Roxanne and the quote, "Well actually, she is a rocket scientist". Then their base password could be : wasiars and then if you have capitialization and special character rules, it could be:

Wasiars1

My point is that as a "regular" user, I find most of the password rules that we are assigned as overkill and think that this actually leads to bad behaviour.

So teach your users well, their father's will slowly pass by.

Styuwtfhwspb1

Best regards,

Kent M. Ostby

[Gavin Clarke]

I personnally don't agree with that 5 password rule and don't enforce it.

However I do think that a world without passwords would still have as many, if not more inconveniences.

The methods we users and administrators use have evolved for a reason.

I am a user and an admin and I understand that certain things, however inconvenient are necessary.

So you think a song would sooth the savage beast of user/admin discord?

[Gavin Clarke]

By the way thanks for the suggestion, I will certainly try to encourage the major offenders as well as tell them off.

Keep the information coming please.

[Steve Lewis]

A security awareness programme is becoming a more common requirement, e.g. BS7799, SAS-70.

I would suggest that you create an internal website on password management and general security awareness, with all the good techniques you can think of for strong passwords, non-divulgence etc.

Then you are going to have to email all of your users to let them know (management as well) that security is THEIR responsibility, just as much as yours.

Most hacking, fraud and ID theft happens on the inside of organisations.

You then have to give your policies legitimacy by getting them approved by your CTO, CFO or CEO with documented sanctions that everyone is aware of.

Then you can check that they aren't sharing usernames and passwords by doing who -u and counting the number of IPs that a single username is connecting from.

There have been a few cases in the news with credit card companies having details diverted by employees. A search on bbc website may help.

[Robert Salter]

Gavin,

Not knowing what your applicaiotns are, you could inform your users that should someone share their login/password with a co-worker and something gets really messed up and the co-worker won't own up to it. Who's to blame the "screwer" or the "screwed"?

People aren't oppose to changes, just the way changes are implemented.

[Gavin Clarke]

Thankyou both.

We have a computer use policy, which does include non-divulgence.

I will have a look at the bbc website.

I'm trying to get them to take the initiative, I can lead a user group to water, but that won't get them to use a more water-tight approach.

I guess it's just a case of working with people and getting them to understand my concerns (although I suspect some think that bad stuff only happens to other people).

My weekend starts today so I'll reply to further posts on Monday.

[rmueller58]

Gavin,

From the perspective of someone that has been doing everything from LAN, PC, Server, WAN, and Unix support for nearly 15 yrs, the "issue" isn't a "system" issue as much as a behavioral one. As someone pointed out, often the stricter "system" policies are, the greater the "threat" users will write done some obtuse password.

Security is an "Inside to Outside" concern.

Physical security keeps servers in a locked closet,
WAN/Firewall security keeps certain servers from exposure to the "world"

System security being the one in question we have to weigh the value of a secure systems against "stupid" users.

Threats are diminished when you "administer" the system by "permissions" rather then passwords. We deal with pinheads daily... I'd "guess" 90% of the password resets I do are because of some bozo leaving their CAPLOCK on. So essentially it comes down to "user intellect" and "common sense." (Which are generally oxymorons).

I get the pleasure of dealing with old women as bookkeepers for schools. No group is less literate in computer systems then this crowd. Try teaching your grandmother about password security.

a password policy for sure is based on what your system and business plan requires. If you are DOD top secret your policy is maybe stricter then a business providing creditcard processing, or a hospital required to handle HIPPA compliance, or an educational entity required to handle CIPPA compliance regs.

I saw recently a large federal entity had one of their exposed websites hacked. While this site hack was clearly not a national threat, the information that WAS available to the public before, is not available now (until they figure out the exposure and fix it)..

I've seen administrators and manager become so ANAL that the USERS become unable to do their work. Don't over do it, and conversely don't under do it. It's a fine line.

[Jan van den Ende]

Gavin,

maybe I _DO_ have an advantage, because of the type of organisation that currently hires me.
It is, _IN PRINCIPE_, a security-aware organisation.
One of the consequences is extensive activity logging.
Another consequence in having an internal "integrity control" department, that has (itself logged!) plowing rights in all (but this last) loggings.
It HAS happened, that internal personnel, intentionally as well as by accident, did security-wise unwanted things, with _VERY_ unwanted effects.

Now, the organisation also has an internal magazine. Under the caption of the chief of integrity control, together with one of his people, I have entered an article in the magazine that roughly described the incident (sufficiently anonymised), emphasising the risks it generated for some collegues, and the adverse effects for the security-violater.
About once a year we run one such article, usually by mixing a few events to anonymise.

And yes, these articles always give some ideas about 'good' passwords. The 'first letters of a favorite ' is the first of those. Specific names in an uncommon language (far-away holidays are a good source) with a special spelling error also do well. (like loose first vowel; swap first/last 2 chars; replace a specific letter by a specific digit...)
Giving some 'strange' examples proves quite inspiring, judging by stories like "well, last time during summer I used the last 3 words in a Xmas carrol, but in reverse order.

And, upon login, each time, each user receives the message:
"Your username and password are YOUR PERSONAL RESPONSIBILITY. Everything on this system is logged, and _YOU_ are responsible for any activity from your account!"

But, only just this morning, an application manager came requesting his applic (dealing with quite sensitive data) be accessible from the desktop without extra authentication "because the users already have access to company systems".
I told him to leave his home front door open, that saves looking for his keys....

... if you can only use one tiny bit of this to increase your users' awareness, then I consider myself rewarded for my effort.

Proost.

Have one on me.

jpe

[Bill Hassell · Accepted solution]

As most people have pointed out, this is not a security problem, it is a behavioral problem. The more complex the password rule choices are, the less secure your systems will be. And the reason is that they are simply too hard to remember, thus yellow stickies and password sharing. In some cases, the helpdesk encourages password sharing with an unpleasant attitude as they fix locked-out accounts.

It's human nature. So there are a few paths to take.

The first is to provide a secure password storage method. The KeepPassword Safe program is an excellent tool. By providing a fast, yet highly secure source for all the user passwords, requiring different passwords for different places becomes fairly easy to handle. This is especially useful for network admins that (ideally) have a different password on every router, firewall, VPN appliance, etc. Get a copy from http://keepass.sourceforge.net/

Another is to provide single-signon capability. This best implemented in LDAP, which HP-UX can have setup and MS Active Directory can participate.

Sill another is the secure token method which can be expensive but can eliminate shared passwords.

Another path is user education in the form of hard-hitting articles about security compromises and the serious business and financial consequences for the companys, their CEO's, CIO's and even their CFO's. Here are some great sources:

http://www.sans.org/newsletters/
http://searchsecurity.techtarget.com/

And finally, you have to get buy-in for enforcing your company's security policy (WHAT? You don't have one?). Once your Personnel or HR director agrees (might be quite a challenge), then managers are directed to not only abide by these policies themselves, but take steps to see that these policies are communicated and then enforced for everyone.

Computer security is not much different than locks and keys.When users constantly have to borrow or check out keys, that's when unauthorized duplicates get made...

[Patrick Wallek]

Another method I have heard of recently is to set your system so it allows long passwords, like 20-30 characters.

Wait, don't throw things at me yet..... Once that is done, encourage users to use passphrases.

Something like:

ihateusingreallylongpasswords!

If I count right, that is a 30 character password.

I think users are morelikely to behave better with passwords if they can remember them.

ihateusingreallylongpasswords! is much easier to remember then ihurlp! At least it is to me.

[Gavin Clarke]

Thankyou all for your help.

I don't think that our password rules are too strict, some of our users don't want passwords at all, which would be ideal but doesn't really take human nature into account. The helpdesk are generally pretty friendly except at 10pm on a Friday/Sunday night, which I think is understandable.

I guess it's partly the fact that the system is only as secure as the weakest link. Running at the speed of the slowest runner is proving to be a bit of a strain. It's good to get some advice and try to open up new approaches.

I shall take a look at those links and ponder all the other nuggets of information that you have provided.

[Jan van den Ende]

Gavin,

to those that want no passwords the standard answer should be:

"Will you please promise to leave all your doors, closets, etc. unlocked, and throw away any keys you have or may get. After that, we will make your account password-free as well, because that is the same".

Proost.

Have one on me.

jpe