Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security

Cutting Security To Cut Costs? 124

Posted by Cliff from the silver-bullets-and-severed-toes dept.
just currious asks: "I work for a large company (10,000+ pc's) who recently out sourced the help desk. After looking at about a year's worth of data we find the 30% to 50% of the calls to the helpdesk are password related (password resets, password changes, etc.) this is alot of calls (at 20+ dollars a pop). Now they want to reduce cost by cutting security, since if you don't have a password, you can't forget it. So here's what upper management wants to do: remove the security from all of our Windows 2000 machines. Has anybody else seen security cut just to save money?"
This discussion has been archived. No new comments can be posted.

Cutting Security To Cut Costs? More

Cutting Security To Cut Costs?

Comments Filter:

  • In order to assist you... (Score:5, Funny)

    by drfrank ( 16371 ) on Friday December 13, 2002 @02:38AM (#4878411)
    We need to first know where you work. Actually, just the IPs will be fine.
  • it depends on whether or not there's anything worth keeping secret on the machines; though someone who wanted in could probably get in anyhow. if i were an employee i'd actually be more immediately concerned about other employees logging in as me and f***ing with my stuff.
    • on the plus side: if you know or can find out managements' usernames you can see what they've been working on ;)

    • Re:give and take (Score:5, Informative)

      by gnovos ( 447128 ) <gnovos@NoSpAM.chipped.net> on Friday December 13, 2002 @04:59AM (#4878878) Homepage Journal
      it depends on whether or not there's anything worth keeping secret on the machines;

      NO! This is a fallacy. It doesn't matter if you have the last remaining digital copy of the secret FBI UFO cover-up or just your grandmother's recipies, your computer itself is still a resource that a hacker would love to use.

      You machine could be hijacked and used for all sorts of nefarious purposes from DDoSing script kiddies to breaking into banks to being an staging point for a credit card fraud scheme or a terrorist network...

  • But... (Score:3, Funny)

    by HRbnjR ( 12398 ) <chris@hubick.com> on Friday December 13, 2002 @02:50AM (#4878449) Homepage
    I thought you said they were cutting security?

    Sounds to me like your Windows boxes will be about as secure as ever :-)

  • A Better Solution (Score:3, Funny)

    by Tuxinatorium ( 463682 ) on Friday December 13, 2002 @02:57AM (#4878468) Homepage
    Fire the morons who forget their password or set it to "QWERTY" so they won't forget. :)
    • set it to "QWERTY" so they won't forget

      Better yet:
      • imaginebeingsostupid
      • toodumbtoworkhere
      • firemeplease
      • firstpantsthenshoes
      • lifttheseatbeforepeeing
    • Oh my. You just released a repressed memory from last week. Somewhat offtopic, but screw it.

      *Someone* sent me an email asking why their password wasn't working. What was it? Q-W-E-R-T-I

      I thought they had to be kidding. "You mean to tell me that after pressing 5 keys in a fscking row you didn't think about pressing the next one?" I had to cry. How long can someone stare at a keyboard for and not even notice when a mysterious voice tells them to use qwerty?

      On second thought, they may be like my dad:

      me: "Type 'cat'. c-a-t"
      him: "uhh.... A.. hrmm... B uhhh.. C! *click*C*click*
      me: !
      him: "uhh.... A! *click*A*click*
      me: !
      him: "uhh.... A.. hrmm... B uhhh.. C uhh.... D.. hrmm... E uhhh.. F............
      me: ZZzzzzz...

      Poor soul. I hear he's gotten better. Instead of spending 45 seconds trying to go through the alphabet and locate the first character of 'ZOO', he found a shortcut - He cheats. he now notices 'z' next to the 'a' and saves a sh*tload of time. Now THAT'S what I call productivity.

  • I've been through exactly the same. (Score:4, Interesting)

    by Anonymous Coward on Friday December 13, 2002 @03:00AM (#4878477)
    I've been through exactly the same. Problems with passwords vanished within weeks as everything was swapped over. Then piece by piece, random pain in the fucking ARSE problems with other users fucking with fileserver files grew into a major problem. Users saved files anywhere they could with no restrictions. Other users who 'claimed' parts of the server space as their own threw out files that appeared there from other users. Management however, are still happy with their decision to cut security like this, despite nobody having a clue where anything is.

    Am I bitter about it? To the point of quitting the instant I can. Thank god I'm not running the servers.
    • Users saved files anywhere they could with no restrictions. Other users who 'claimed' parts of the server space as their own threw out files that appeared there from other users.

      This is an excellent point. Many users have no concept of a directory structure and save files in almost random locations. When I was a network administrator we spent time locking down the users' NT boxes; not for any security reason, but to prevent the users from saving files anywhere but on the server.

      Now instead of before where a user would call and the support person would change their password (a fairly easy problem to diagnose and correct), your support people are going to spend the first few minutes of any conversation trying to determine who the user is even logged in as. Account swapping is going to be a whole new fun area of technical support as users just use each other's accounts to accomplish tasks rather than deal with problems with their own accounts.

      If your management isn't impressed with security concerns, maybe this line of reasoning will help. I guarantee you that your employees are already trading passwords and accounts in a limited fashion to get work done, removing passwords will cause an explosion of support issues. Good luck to you.

  • BOIH (Score:5, Funny)

    by jsse ( 254124 ) on Friday December 13, 2002 @03:01AM (#4878478) Homepage Journal
    Now they want to reduce cost by cutting security, since if you don't have a password, you can't forget it.

    You obviously not a BOIH(Bastard Operator In Hell):

    "I lost my password."
    "You've no password."
    "What do you mean by no password? What's that big f%#*ing word on the screen saying 'Password'?"
    "Just press Enter."
    "small cap or all cap?"
    "...."
  • So here's what upper management wants to do: remove the security from all of our Windows 2000 machines.

    No sweat! *pause 3 sec.* It's being done!

    *thank God not being asked to remove security holes*
  • You should hock your building's alarm system, and the lock cylinders in the doors; that'll bring you a few quick bucks.

    Nothing like running lean and mean!

  • My 2 cents (Score:5, Insightful)

    by RyoSaeba ( 627522 ) on Friday December 13, 2002 @03:19AM (#4878524) Journal
    I guess it depends on many different factors. You have to ask yourself (or make the managers ask themselves ^_-) at least those questions:
    • are there sensitive documents on the network, which shouldn't be readable by some users ? If yes, you'd better leave those passwords, since if you remove'em, anyone can log in as a manager & read that data. And forget those nifty Word / Access / whatever password protection, people need 10sec to find the password... The only way is to prevent users from reading files using groups access control & such, something easily defeated if no password...
    • do you trust all your users ? again, removing passwords will enable anyone to log as anyone & create havoc w/o being able to find who did it, since the login won't help (maybe combination of which computer that was from & the time, but that may not be enough)
    • are your users sufficiently educated to know how to use computers ? Meaning, are they responsible enough to understand what no passwords will mean, and act smartly accordingly ?
    • study with your manager the security risk involved with having much data erased by someone who used a high-level account to trash many important files. Are your backups done often enough ? How long to recover everything ? Is it worth the spending of removing passwords ? (ok, that's a question you probably ask yourself often enough, but removing passwords will increase the risk of random file deletions IF users want to create havoc)


    Where i work the security is pretty tight (comp locks after 5mins of inactivity, many things turned off, and so on). It's sometimes a pain in the ass, but at least they really take security into account...

  • F^cked Company (Score:3, Insightful)

    by Heinr!ch ( 631474 ) on Friday December 13, 2002 @03:26AM (#4878537)
    Once they do it, you should post the name of your company here and and at FuckedCompany.com so we can all avoid giving this company any of our personal information.

  • How about this? (Score:2, Interesting)

    by Kaeru the Frog ( 152611 )
    Keep the passwords and charge anyone who forgets their's twenty dollars.

  • *sigh* (Score:5, Interesting)

    by skinfitz ( 564041 ) on Friday December 13, 2002 @03:42AM (#4878602) Journal
    Unfortunately this is a fact of IT - there are those who because they dont understand the need for IT security, means that you are reduced to working at their level.

    How many times have you heard this one?

    (Regarding a server that is connected to the net for FTP / SSH) "But who would want to hack our server?"

    I've often found that lusers actually do understand security concepts, however as soon as a computer is concerned they are thrown out of the window. For example:

    Me: "Tell me - do you drive a car?"
    Luser: "Yes"
    Me: "And does anyone have a specific grudge against you? Would they specifically want to steal your car?"
    Luser: "No!"
    Me:"So do you lock your car after you park it somewhere?
    Luser: "Of course I do!"
    Me: "So if no one wants to steal your car, why do you lock it?

    I've found they can't answer that one.

    The real issue is that people just cant use computers. What would solve the problem would be some form of transparent biometric authentication. Think about how we as human beings authenticate people - we do it all the time from speaking to friends on the phone, to making a transaction at the bank. If speaking to someone you know, you dont use a password - you know what your friend looks, sounds and behaves like, and this is used for "authentication". With a bank, you may not know the person you are about to hand over all your cash to, however because the bank is a big building in the location it's in, you know that it can be "trusted" due to it's physical location.

    Regarding passwords with Windows 2000 there are alternatives to this. The simple one is let them have no password, but make it so that their account can only log on from their computer. That will seriously limit the abuse that can happen. Alternatively just quietly delete all your CEO's MP3's and mail abusive messages and pr0n using his account - he'll soon wake up.
    • Now you answer me two questions:
      1)What would I lose if someone stole my car?
      2)What would I lose if someone hacked into my pc?

      I'll answer that for you.
      1)I dont have a car, but if I did, I would lose valuable property that cost me lots of cash and hard work.

      2)NOTHING! There is nothing of value in my pc! Zero!
      If someone came and deleted all my files, why should I care? I can restore everything to working order in 3 minutes by getting my disk image CD.
      So I might lose some porn or mp3s. It's not like I dont delete everything on a regular basis myself!

      Most people dont worry about security because they dont need it! A bigass company with mission critical data should definitely worry about security but you cant criticize someone for not locking their electronic toybox.

      Speaking of which, have you locked your fridge recently? How about your oven? Your closet? Do you have locks on everything you own? You dont, do you? Well I dont either, and I dont use a firewall or anti virus or anything... and guess what, no computer problems whatsoever...

      • Re:*sigh* (Score:5, Insightful)

        by gnovos ( 447128 ) <gnovos@NoSpAM.chipped.net> on Friday December 13, 2002 @04:53AM (#4878856) Homepage Journal
        2)What would I lose if someone hacked into my pc?

        The question you MEANT to ask is: What would I lose if I someone hacked into my pc and placed child porn in my personal directories and then called the FBI on me?

        A) 5-10 years of your life... You only need to possess it, not even have knowledge that it is there.
        • Hey guess what, I'm not american!
          No FBI for me. Or DMCA. Or any other kind of insane law enforcement. Or hardly any law enforcement, lol.
          Maybe I should put my nationality in my sig or something. I am from Portugal :)
          Why don't you all move here, there's also hardly any unemployment and a great lack of qualified people since half the ppl around here don't go beyond the mandatory 9th grade in their schooling.
          And the weather's great too!
          • But you speak Portugese and have the unsafest roads in Europe.
          • "No FBI for me. Or DMCA. Or any other kind of insane law enforcement."

            Don't worry, we're working hard on that.
          • Are you saying that there is nothing at all that is illegal in your country that can be done on your computer? If your machine were being used to host a terrorist information network, a conspiracy to kill leaders in your government, commit credit card fraud, hack into banks, etc, you could escape all accoutability just by saying "Hey, my machine was hacked, it wasn't me, I swear!"?

          • Re:*sigh* (Score:3, Insightful)

            by MrResistor ( 120588 )
            Yeah, well, Dmitry Skylarov isn't an American, either.

            Jon Johanson is not only not an American, but has likely never been to America, and lives in a country where reverse engineering is supposedly still legal.

            I'm going to take a wild guess and say that kiddie porn, sedition, and terrorism are still illegal in Portugal, despite the relative scarcity of law enforcement. Even if they aren't illegal, or are but aren't enforced, there's still this little thing called "extradition". There aren't that many countries in the world that don't have extradition treaties with the US, and I don't recall Portugal being on that list.

            If you think the US can't put enough pressure on your governemnt to get you if it's important to them, I'm going to guess that you haven't gone much past the government mandated education yourself.

            Remember, the program Skylarov wrote is not only explicitly legal in Russia, but Russian law makes Adobe the criminals for limiting access to purchased works. That didn't stop the FBI from nabbing him though, did it?

      • Speaking of which, have you locked your fridge recently? How about your oven? Your closet? Do you have locks on everything you own? You dont, do you?

        If my fridge were exposed to the outside world, then I would lock it. I don't need to lock it because it is within my house, and my house is locked. My house is acting as a security provider in this scenario.

        Well I dont either, and I dont use a firewall or anti virus or anything... and guess what, no computer problems whatsoever...

        You're not trusted with anything important are you?
      • 2)NOTHING! There is nothing of value in my pc! Zero!

        Your computer has no CPU? No Hard Drive? No internet access?

        Those are the only things of value on the vast majority of computers that get hacked, but they are of value.

        What if a hacker is using your machine to hack into something important, like the NSA or a Defense Contractor? Or, of course, there's the kiddie porn example already presented. Or maybe you'd like your computer to be a zombie for a DDOS attack or a spammer?

        Most of those could get you any combination of: Computer confiscated as evidence (the computer itself is of value to you, right?), heafty fines, or jail time. In the kiddie porn example it doesn't stop there, either. You'll be in a sex offender database for the rest of your life, which means every time a child disappears you're a possible suspect, and as an added bonus every time you move you'll likely have to go around your new neighborhood and introduce yourself and your crimes. "Hi, I'm your new neighbor, eggstacy. I just moved in down the street, and I'm required by law to inform you that I'm a convicted sex offender." Fun for the whole family!

        Oh, and they did mention that it doesn't matter whether you knew the kiddie porn was on your HDD or not, right?

      • OK, never mind the content on your box currently. If somebody cracked your internet account, they could:

        1) Send spam in your name

        2) DOS machines in your name

        3) Wreak general mayhem about the 'net in your name

        And ultimately, cause you to lose your precious internet access.

        So what if they wanted to break into your computer? Then like other users suggested here, they could stick kiddie porn on your machine and call the FBI. Not my idea of a good time.

        Moral of this message: you need security like you need to wear clothes. An inconvenience, but it keeps you from getting into trouble.
    • The real answer is "If it takes a locksmith less than 2 minutes to get your keys out of the car for you, why did you lock it in the first place? Didn't you realize that a criminal can do the exact same thing a locksmith does, only faster?"

      Locking a car is often a pointless task. It's much better at preventing casual entry by children then by actually deterring theives. In a corporate enviroment, the task should be to secure access to the hardware.

      If you can keep the building secure, the only people who can penetrate the security system are the people who penetrated building security. Since anyone within the building usually has free reign to wander around until they find a PC that's still logged in, the final security measure of a log-in is relatively worthless.

      Of course, the real test to keep in mind is the courts. If someone else's data is stored on the machine and that machine is not password protected, expect to lose the lawsuit. In the modern world, it's still important to do something after the horses have left the barn.
      • Passwords facilitate accountability. If fraud is committed how do you track it without passwords?

        Handwriting recognition?
        (not on a computer)
        Logs of physical location?
        (not when all the data is accessible from one desk)

        When a client give me an account to their system, I specifically ask for no production system access. I don't want the liability. I would be concerned working in an environment where trouble couldn't be tracked to someone else.

        Joe
        • In the corporate enviroment, using a password as an tracking device is probably the worst move you can do. In many enviroments the person using the machine is not the person who first logged into the machine. This is especially true on larger enviroments where the start up time is prohibitively long. No one wants to log off and log on again, especially with products line Norton Zenworks and other launchers which, in the course of delivering constant updates to the system also deliver constant reboots.

          You would be much better off using keycards or similar devices for tracking purposes as the changing of the user in that respect is a per-application change and the user is much more likely to take the card with them when they leave the workstation. (It's relitively painless and therefore a trainable behavior, where logging off and logging on is often painful and therefore avoided.)
          • I've never been in a corporate environment where there weren't passwords and enforcement of their usage (auto screen saver locks, employees held responsible for actions taken using their computer accounts, etc.)

            How is a key card different than logging off? Does the key card not change the effective user id? If it does, then how is it faster than logging of and back on? If not, what good is it for tracking users?

            Joe

      • Re:*sigh* (Score:1)

        by eht ( 8912 )
        I've heard insurance companies won't cover it if your car wasn't locked, i'm not sure I believe that one.

        Insurance Company = "Was the car locked?"

        Car Thief = "Uh no"

        Insurance Company = "You're free to go"

        I do *know* that insurance companies sometimes/often make decisions for the "customers" without asking their customers, like paying out to people even though their customer wasn't at fault.
    • *sigh*

      The real issue is that people just cant use computers. What would solve the problem would be some form of transparent biometric authentication.

      I'm sorry, but this isn't a solution. Your first sentence says, 'this is a training (i.e., non-technical) problem'. Your second says, 'let's solve it with technology'.

      Since I'm a broken record, I will repeat:

      You can't solve a non-technical problem with a technical solution.
      What you really need to do is train your employees. Anything short of that won't solve your problems.

  • Cutting costs - false economy (Score:3, Insightful)

    by skinfitz ( 564041 ) on Friday December 13, 2002 @03:46AM (#4878619) Journal
    If they think it's expensive to run now, just wait until they get the repair bill after it's been run with no security for a while.

  • Wouldn't work in Europe (Score:3, Informative)

    by NeoEinstein ( 625476 ) on Friday December 13, 2002 @03:46AM (#4878620) Homepage
    Here in Europe, some countries have laws sayingthat the management is liable if the get broken in (cracked) and the IT security was too lose ! That's the only language Managers are understanding, so I think it's a good idea, no ?

  • What's better than no password? (Score:2, Interesting)

    by Anonymous Coward
    ONE PASSWORD!

    Yes, that's right, retain some security while still making it super easy on everyone. Perhaps you could even change the password monthly... to the name of the month! (Although that might confuse some people and create more problems.)

    Anyway, one password for every user is the compromise that will make everyone happy.
  • Since the lusers can't remember, then switch to a system that relies on a physical item for the security. Do the employees have ID cards? If so, chances are those could be used for a login system (RFID tags?).
    As for explaining to management why passwords are a good idea, ask them if they would like to see their salarys/bonuses/private email show up on F--CKED Company.com (not as a threat, just to point out what can happen when accounts aren't secured without a password or equivilent.)
    • how about USB keychain hard disk?

      Or show them how with no passwords someone can get to _their_ personal files.

      You need to have authentication of users. If you have to allow no passwords, then make one user login with no password. Then by default uses that account. Those competent employees that can remember(not writing it down) a "decent" password should be allowed to aquire a personal passworded account. Then make it cost to reset a password.

      The non-passworded account could then be controlled from running rampant. While the more competent users would be allowed the security of operating in a secured environment.

  • Yeah, but the hackers don't want you DATA, fool. They want a place to put thier kiddy porn and tcp reflectors for hacking NSA computers and sending death threats to the president...

    No, you don't have anything on your network worth stealing ... especially now that all your machines have been confiscated as evidence. :)
  • But doesn't the directory design in 2000 let you organize things into nice little containers where you could then delegate responsibilities? And doesn't windows 2000 have a "taskpad" or something, that you could say use the delegation infrastructure to give someone close to the convienent units, embodied in the little containers, the very limited ability of modifying passwords.

    I get the distinct impression your employers aren't using the features that come with the very expensive software, that they're buying the very expensive service for. I can't really say whether its a security, or even a software issue. The problem seems obfuscated by significant human resource difficulties.

    As an aside, I can't say I'd be opposed to learning what company we're speaking of. I've taken enough of a bath in the market, and this would certainly seem like a good indicator to sell.
    • But doesn't the directory design in 2000 let you organize things into nice little containers where you could then delegate responsibilities?

      Yes it does. They're called OU's. They're a BASIC and fundamental part of Active Directory

      And doesn't windows 2000 have a "taskpad" or something, that you could say use the delegation infrastructure to give someone close to the convienent units, embodied in the little containers, the very limited ability of modifying passwords.

      Yes it does. In fact it can all be done with a wizard called interestingly enough the delegation of authority wizard

      MOst companies would do just what you've proposed have one person designated for each area/department/site or whatever to just do password resets. Total cost = 0

  • Sadly enough... (Score:4, Funny)

    by iq in binary ( 305246 ) <iq_in_binary AT hotmail DOT com> on Friday December 13, 2002 @04:53AM (#4878857) Homepage
    Yes, I have.

    Moronically, the highschool I was currently attending. I was the "Assistant Admin" (i WAS the admin, don't let the name fool you).

    My principal started getting sick and tired of her front desk people having all of their time wasted by students asking their student numbers (also their password).

    She came to me saying to take all passwords off, period. The only exception, mine.

    It took 400 flunking students getting straight A report cards magically to set her straight.

  • How often to you force password changes? (Score:5, Insightful)

    by iangoldby ( 552781 ) on Friday December 13, 2002 @05:02AM (#4878895) Homepage
    Forced password changes => lots of help desk calls.

    What is less obvious is that they don't lead to any significant increase in security. Most people, if forced to change their password every month, will use something easy to remember (and easily guessable), like qwerty1, qwerty2, qwerty3, etc. But they still can't remember which version they are currently on, hence the help desk calls.

    If you force users to choose strong passwords but not to keep changing them, you'll get both an increase in security and a decrease in help desk calls.
    • I am not an IT security professional, but from my limited experience, this is 100% on the mark. It's much easier to remember a single 10+ letter/number/symbol password than it is to be forced to change a password once every month with only a six-letter minimum requirement. Some people have devised calendar schemes of changing their secure password, but these people are few and far between.

      As an IT security administrator, the smart thing to do would be to require a password that is 10 characters minimum (with numbers or symbols required). Then give plenty of suggestions to users for how they can devise a rather random password (e.g., think of a favorite song, then use the first letters of lyrics from a verse of that song, with numbers or symbols separating sentences). Then force them to change it once a year or so.

    • We've got a centralized password thingy, where you have one central password and all sorts of web applications, desktops, etc. all validate against this central server. But there are still problems with some applications that don't work off of this centralized lookup, etc. And centralized password control means that if one account is cracked, the others are wide open.

      A good setup IMHO would be to give each user two or more graduated levels of passwords. One password is for their own personal info on HR's page, access to management evaluations of them, etc. - they can decide how secure to make it. Another password is for all business-critical information and apps; you rotate this one every month or two. Another password is for general non-confidential business info; you rotate it once a year or something like that. All applications at a particular "security level" use centralized validation and share the password per user per level. The user account for each is the same, so you maintain accountability even for non-important stuff.

      So you have relatively few centralized passwords, but they still are changed based on the risk of what would happen if they became known.

    • That's somewhat true, but it ignores one of the larger reasons that you force password changes in the first place. Obviously, any password that can stay secure over time would never need to be changed except for one thing--brute force attacks. The idea behind forcing password changes is that even if somehow someone gets hold of a set of your encrypted passwords, by the time they manage to crack one, it will have changed.

      There's a decision to be made, obviously, as to how great a risk that is versus the cost of having someone deal with lost or forgotten passwords, but if 'qwerty1' is secure from a cracker (yes, I know, it's just an example) then 'qwerty2' is no less so--I've not seen a brute force cracker bright enough to extrapolate even simple tweaks like that, even though a human might do so.

      Guessing is a different matter, but sufficiently enforced rules cut down on guessability as well.

    • If you force users to choose strong passwords

      You don't force users to choose strong passwords. They probably have different opinions about what makes strong mustard, you think they're gonna understand your obscure criteria? You give them strong passwords and tell them to memorize. If they don't like '1mA1uZ@r', you can always give them '$m3L1Y@$5'.

  • security policies (Score:5, Insightful)

    by doofusclam ( 528746 ) <slash@seanyseansean.com> on Friday December 13, 2002 @05:27AM (#4878957) Homepage
    Surely the most sensible way of sorting this out would be to have a trusted member of staff in each building/department/whatever with the authority to reset passwords. Note, I said *reset* passwords - not the ability to read them.

    seany
    • most sensible idea so far...

    • Re:security policies (Score:3, Interesting)

      by sigwinch ( 115375 )
      Even better way: bill the user $20 a pop. People magically get more careful when it's their money that's being pissed away.

    • Re:security policies (Score:4, Interesting)

      by Clover_Kicker ( 20761 ) <clover_kicker@yahoo.com> on Friday December 13, 2002 @09:10AM (#4879796)
      >Surely the most sensible way of sorting this out
      >would be to have a trusted member of staff in each
      >building/department/whatever with the authority to
      >reset passwords. Note, I said *reset* passwords -
      >not the ability to read them.

      I once worked at a place where getting your mainframe password reset required getting your manager to sign a form. You took this form down to the data center, where a smirking operator would reset the password.

      This is excellent psychology -the user has to interrupt their manager to explain that he/she/it is a bonehead, please sign this form.

      So now you've embarrassed the user, and better yet, the boss is annoyed at the user! If the user is a repeat offender, the boss doesn't get mad at those evil IT guys and their password policies, he gets mad at the bonehead who can't remember their password and keeps bothering them. Ah, sweet justice.
      • Unfortunately this will only encourage people to write their password down and tape it to the bottom of their keyboard so they don't have to be humiliated by their boss.

        You gotta get people to buy into the idea of security. If they don't, they'll only try to get around your security measures every chance they get.

        • >Unfortunately this will only encourage people to
          >write their password down and tape it to the bottom
          >of their keyboard so they don't have to be
          >humiliated by their boss.

          One former job (not the same one) had a policy that "having a password written down is grounds for termination".

          That policy worked well IMHO, I push for a similar password policy wherever I go.

          They always shoot me down :)

          However, subsequent events generally provide me a chance to do my "I told you so, but you wouldn't listen" song and interpretive dance.
          • Gee, and all this time I thought that it was gross misbehavior or not doing your job effectively that would justify firing someone (as opposed to downsizing them, yes).

            What a moron I am. Apparently trying to do your job by carrying your password around (required: at least 8 characters, with one uppercase, one lowercase, one nonalpha, and at least one ancient hebrew or easter island character) should be grounds for planting your foot in their ass Mr Dithers style (well come to think of it he rarely fired dagwood).

            You are a system administrator. Let HR do their damn job, you do yours.
            • >Gee, and all this time I thought that it was
              >gross misbehavior or not doing your job
              >effectively that would justify firing someone

              OK, here's a true story for you.

              A particular HR person *always* had their password written on a sticky on their monitor. This person's account would have access to payroll info, employee records, and other confidential information. Is that employee doing their job effectively? Does this qualify as gross misbehaviour that deserves firing?

              >You are a system administrator. Let HR do their
              >damn job, you do yours.

              The guys at purchasing don't sit around scheming to fire people. Regardless, if I break the rules about how equipment is bought, I will be fired.
  • Having no password is just asking for trouble.

    Instead, just make every password the same, and make sure it's printed on posters all around you workplace!

  • I must be bored... (Score:3, Funny)

    by PerryMason ( 535019 ) on Friday December 13, 2002 @06:55AM (#4879289)
    I was reading a few posts in this thread and started thinking "Hmmm, so he works for a BIG company. There might be some chance such a person would be googleable." So I looked at the email of the poster, griffis@mailexcite.com and google away at griffis.

    The first few pages showed nothing, but then BINGO!!
    http://www.nab.org/conventions/includes/p articipan tbio.asp?id=10985.

    Finally MS is implementing the security policy they always wanted. ;)
    • Perhaps a "Killer prison guard"?
      http://members.tripod.com/~MerlM/
      http:/ /www.angelfire.com/fl4/prison/lawsuit.html

      Or a national guardsman who lived through a tornado?
      http://enquirer.com/editions/2000/09/23/ loc_its_de ja_vu_for.html

      A boozer?
      http://www.stater.kent.edu/stories_old/01 fall/1030 01/blotter.html

      Or maybe he's just not quite so googleable -- on the other hand, based on Microsofts security track record this isn't entirely unbelievable... Close, but not entirely...

  • Message from the CEO (Score:3, Interesting)

    by martin ( 1336 ) <<maxsec> <at> <gmail.com>> on Friday December 13, 2002 @07:08AM (#4879337) Journal
    OK so point what no passwd will give you.

    Complete and utter ability to impersonate your upper management, sent out emails supposedly from them and read all their files(assumming you're running AD for NT domains and the email uses the AD etc for authentication)....

    What other risks to the business can you think of -

    the cleaner can get as anyone...
    people can update documents they aren't supposed to..

    the list goes on.
  • by removing security from Windows2000? As in guest login with no passwd or no passwds at all for any user??

    Setup a web page interface to a database that maps peoples names, zip codes, mothers maiden names, creditcard nos and passwords. Better yet add a phone interface, this will be cheaper and better than a full-fledged helpdesk.

    At the least you could put up a webpage that allows users to reset their passwords to their credit card numbers or SS no. Simple effective and stable web/phone interfaces will do a better job than helpdesk staff.

    All this is assuming you have LDAP or other central authentication service. If you do not, hire me :) or just about anyone else on slashdot.
  • an Ask Slashdot?
    or better yet... an entry on F*ckedCompany.com [fuckedcompany.com] ?
  • Tell upper management, that turining off security is not an option. What it sounds like you need more is a solution that maintains security while stille providing the cost benefits of not having to reset passwords daily. You need an identity management solution, or at the very least, a single sign on solution... There are numerous password propogation, synchronization, IM and SSO soloutions available. Find something that will fit your environment, and run with it. Letting it get to the point where an innocent says "Can we turn it off?" is not going to help you, and you're to fault just as much as the suits when you get hacked because you LET it happen.
  • Note that doing this is not smart, but here is how it can be done in WindowsNT. The registry in Windows2000 is not much different so it should work. MS's KnowledgeBase has an article on how to set this up if you need more details.

    In the following registry key: HKEY_LOCAL_MACHINE -> Software -> Microsoft -> WinNT -> CurrentVersion -> WinLogon

    Set the following registry values:
    AutoAdminLogon -> 1
    DefaultUser -> luzer
    DefaultPassword -> password
    DefaultDomain -> somedomain

    Then reboot the system and logon as luzer. Now everytime the system is turned on, the system will automatically logon as luzer.

    The above information was from memory, so you should verify it's accuracy before using it. Since Windows2000 likes to use Active Directory for everything, the DefaultDomain entry may have changed.
  • First, if you are behind properly-maintained firewalls, and the Win2K boxes are properly configured (running no externally-accessible services unless they are a server, etc), then it's likely that you could get away with this without getting hacked externally. However, disgruntled employees are going to be a problem.

    A better response is to force the user to use a password including a capital letter, a lower case letter, a digit and a non-letter character; to be at least 8 characters long; to never expire and have no history. Then the user is forced to pick a (relatively) good password, and won't forget it.

    My company forces a password reset every 90 days, and won't let you reuse the last 8 passwords. I have my normal 2 strong passwords, then I go into a cycle of fairly weak (but easy to remember) passwords. At least it's not like when I was at IBM, where everyone had their RETAIN passwords written on the whiteboards (5 characters, randomly assigned by the computer every 30 days!).
    • Where you born stupid?
      The users have having problems forgetting passwords, eg:
      qwerty
      qwerty1
      qwerty2
      "shit..I forget if my passwords qwerty1 or qwerty2.. I could try and figure out which one, but I'll just call the help desk."

      Read the Fricken Ppppppppppppost.
      • Clearly, you missed the point. I was in the second paragraph giving a more reasonable password policy than most companies use (and certainly more reasonable than having *no* passwords) and then followed that up by giving a counter-example; well, two counter-examples.

  • Here's a cheap and semi-secure solution (Score:3, Interesting)

    by Muad'Dave ( 255648 ) on Friday December 13, 2002 @10:39AM (#4880282) Homepage
    Set up a web portal that the users use to request their password. Have it send their password to a "dectalk" (voice synth + phone dialer) that dials their voicemail account and speaks the letters of their password. This provides some security, since they still need their voicemail PW. It will also alert a person if someone tried to get their password - an unexpected PW message will appear on their phonemail.

    You can get by with only one dialer 'cause you can just batch up the requests and do them sequentially. I'm sure there are a jillion ways to get the telephony/voice synth part working. There's Bayonne, etc. Since you're only talking about letters, numbers, and punctuation, you could just have someone read the letters into WAV/MP3 files and stream them into a voicemodem. Just a thought!

    • PS - you could even have it change their password and read them the new (random) one for added security. If your system supports it, it could even make the new password expire on first use, so they'd have to change it. Alternatively, have it refuse to change the random password for 30 days, so they'd have to use the ugly random PW instead of qwerty1.

    • its awful hard to go to a website to request your password if you can't log in to your computer (yes, you could bug a coworker, but then you're still wasting company time to have your password fixed)

      if the phones aren't on a lock, then an automated touch tone system would work.

  • And do they offer public stock?
    If so, I'm going to buy a few shares so I can sue them for mismanagement.
  • check out True Systems [truesystems.com]

  • Hire a intern that does nothing but reset passwords. You can set up a script in NT/linux/solaris what ever that only has this ability.

    Pay him nothing if it is and intern, or pay him the minimums. Force him to sign a security agreement first of course.

    Now what you have is someone that is getting paid next to nothing that has taken 50% of your work load out of the picture costing less than anything upper management could ever dream.

    My suggestion is that you find someone in your family, friends, or something like that. Someone just out of high school that you have a personal contact with. IE you can trust him more than the average joe. Then lay it out for them "look man, I have a job where all you have to do is change passwords all day and you can study, play games, etc..etc.. and get paid like you where flipping burgers.". Dream job for the average noob computer guy.

    good luck,

  • This is really not that complicated to solve. It is simple to assign someone the rights to change/reset passwords, without giving them any other administrative priveledges. Assign a person in each department the ability to do password resets.

    You'll probably need to make it a secretary or similar, but ideally it would be the managers so they can actually appreciate which users are on the ball and which are completely inept.

    You get to maintain reasonable security, you save the cost of all of those unneccesarry help desk calls, and your management gets a little more perspective on who they have working for them. Problem solved
  • C'mon, they've been cutting costs on security for years by providing less and less of it...

  • Before I get into WHY I say that, allow me to comment that I cannot envision ANY company the size of yours being run by people who are so goddamned bone-headed.

    Ask your General Counsel if he would be happy to have each and every one of your company's business records rendered inadmissible in court if the company gets sued or sues someone else.

    Security features like (DUH!) forgettable passwords allow you to PROVE who has accessed the documents and databases on your network. This is why MOST company's make it a termination offense to reveal your username and password to anyone else, employee or not.

    Without secure logins, documents and business records can be tracelessly forged or falsified. The ONLY reason business records are admissible in evidence over a hearsay objection is because normal record-keeping practices TEND to cause them to be more reliable than other hearsay evidence. A soon as these records can be accessed by multiple persons without being able to prove WHO actually accessed them they become worthless.

    If this is a publicly-owned company, PLEASE let us know which one it is so we can divest ourselves of its stock BEFORE they do something this outrageously STUPID!
  • My (rather cynical) recommendation: let 'em do it. Natural selection at work. Ifthe entire system goes down the tubes because of a security breach, the "upper management" responsible for the farce will go with it. Hopefully, no one else would be affected. However, If everything turns out OK you don't want to be known for obstructing what was an "obvious" cost-saving move.

    Folks around here are downright extreme about security (OK State Univ was mentioned on Slashdot a couple of times for it), so anyone who seriously tried to suggest such a silly idea would be out on the street in a heartbeat.
    • Yeah too bad natural selection doesn't really apply to human social networks. An observation Darwin himself first made if I'm not mistaken.

      Humans protect one another and share resources in innovative ways. The upper management would float away on a cloud of money while the people who weren't at fault find themselves in court tearing at what's left of the looted corporate carcass to get their pensions, 401k's or even just their last paycheck.

      Look at Enron. The officers of that company left a swath of destruction so wide it's counted only to the nearest billion. You think Kenny Lay isn't going to be living in a mansion while he sees his kids off to ivy league schools and pulls down huge consulting fees after all is said and done? Christ, Bush is trying to appoint a friendly family friend who's being sued for fraud so he can "bring integrity back to the SEC!"

      Appearently, the meaning of integrity has changed a lot over the years.

      A funny aside. When I was a frisky metallurgical engineering student back in the day. We were told we had to take an ethics class. And unlike lawyers, we as engineers couldn't afford to pay it lip service. If we cheat, people might well die. In scores. Fair enough, I'd always thought of myself as a pretty ethical person; a trait I can't say has served me well, incidently. If you ever doubt the world is cast in shades of grey, subtle variations of hue, your ethics professor telling you it's ok to lie on your resume will swiftly disabuse you of that notion.
  • Making systems boot up and login non-interactively
    is hardly "removing security". How do you see
    that doing so would materially change the practical
    security of your organization's data? Systems
    are almost always logged in anyhow. That's why
    nobody can remember their password. (You might
    get the same sort of savings with a material
    increase in "security" by enforcing password-protected
    screensavers everywhere, because then the
    passwords would always be in mind.)

    "Security" is mostly a waste of time and money, and
    only has value when it defends against an actual
    breach. It is wise economic planning
    to marshall your resources to address the cases
    with favorable cost/benefit. Surely you don't mean
    to argue that the decision is erroneous if it results
    in a net savings? If you do, then "security" is a
    religion for you, not a tool.

    All too often, security means you can't do your job.
    The $20 for the support call is just the tip of the
    iceberg. It's the 2 hours that a meeting to close
    a $500,000 deal gets delayed, or the hour that
    two $300/hr consultants cool their heels while
    Mr. PHB deals with support that are the real costs
    here.

    • Making systems boot up and login non-interactively is hardly "removing security". How do you see that doing so would materially change the practical security of your organization's data?

      What you're doing is making it far easier for someone to access information that they shouldn't on the spur of the moment. I would hope that part of the reason they're getting all those calls about passwords is because users' workstations lock by default when they're idle. If not, every file on every machine is potentially available to the cleaning staff, visiting A/C or phone technicians, clients waiting in an empty office...if you have data on those machines (email? memos? unreleased product information?) that you don't want the outside world to have access to, you're incredibly foolish to make no effort to secure them.

      "Security" is mostly a waste of time and money, and only has value when it defends against an actual breach. It is wise economic planning to marshall your resources to address the cases with favorable cost/benefit. Surely you don't mean to argue that the decision is erroneous if it results in a net savings?

      Here I really disagree. If you're "defending against an actual breach," which is to say dealing with a situation where you're already been compromised, that's not security . Yes, you do a cost/benefit analysis, but that analysis isn't "it costs us $x per year to reset people's passwords, and $0 to simply do away with the passwords."

      Maybe some of those workstations don't need to be locked, and you can cut down on calls by leaving them open...but you have to consider the potential costs associated with lowering security: what if the data from that computer is made public? Could someone install malicious software on that machine, and what would the potential damage to the network be? What other machines could someone access from that workstation? The potential costs in system damage, lost business, etc. may end up making the costs of those password calls look like a good investment.

      If you don't evaluate the potential costs of a security breach, you're in no position to decide whether or not there's a net savings.

  • fantastic... probably the best idea I've ever heard... . ..say... where do you work? :)


  • Author unknown, but it's a classic! (and for once, RELEVANT!)

    Password selection rules
    CORPORATE DIRECTIVE NUMBER 88-570471

    In order to increase the security of all company computing facilities, and to avoid the possibility of unauthorized use of these facilities, new rules are being put into effect concerning the selection of passwords. All users of computing facilities are instructed to change their passwords to conform to these rules immediately.

    RULES FOR THE SELECTION OF PASSWORDS:

    1. A password must be at least six characters long, and must not contain two occurrences of a character in a row, or a sequence of two or more characters from the alphabet in forward or reverse order. Example: HGQQXP is an invalid password. GFEDCB is an invalid password.

    2. A password may not contain two or more letters in the same position as any previous password. Example: If a previous password was GKPWTZ, then NRPWHS would be invalid because PW occurs in the same position in both passwords.

    3. A password may not contain the name of a month or an abbreviation for a month. Example: MARCHBC is an invalid password. VWMARBC is an invalid password.

    4. A password may not contain the numeric representation of a month. Therefore, a password containing any number except zero is invalid. Example: WKBH3LG is invalid because it contains the numeric representation for the month of March.

    5. A password may not contain any words from any language. Thus, a password may not contain the letters A, or I, or sequences such as AT, ME, or TO because these are all words.

    6. A password may not contain sequences of two or more characters which are adjacent to each other on a keyboard in a horizontal, vertical, or diagonal direction. Example: QWERTY is an invalid password. GHNLWT is an invalid password because G and H are horizontally adjacent to each other. HUKWVM is an invalid password because H and U are diagonally adjacent to each other.

    7. A password may not contain the name of a person, place, or thing. Example: JOHNBOY is an invalid password.

    Because of the complexity of the password selection rules, there is actually only one password which passes all the tests. To make the selection of this password simpler for the user, it will be distributed to all supervisors. All users are instructed to obtain this password from his or her supervisor and begin using it immediately.

  • So here's what upper management wants to do: remove the security from all of our Windows 2000 machines. Has anybody else seen security cut just to save money?


    I've got some Windows 98 CD's you can have for free around here somewhere....

  • Well, not exactly.

    I work as a security auditor for an accounting firm. I go in ahead of the auditors and sign off on the systems in use in the company and basically give the OK for the auditors to come in and do their job.

    If I discovered that a company hadn't taken as simple and easily implementable security precaution as passworded access to systems, I would simply say in my report that the auditors could not rely on the evidence provided to them from the company.

    This is VERY VERY VERY bad. CIO's can, have and do get fired over less than this.

    Auditing standards for security are (frustratingly) low, and yet if you don't pass them and you're a publicly traded company - you're fucked. If you're a private firm, a partnership or anything where someone else doesn't actually own the company - do what you want. If you're public, you're assuming an ENORMOUS risk. (Here I mean risk in the business-audit sense of the word.)

    Basically, if you implement this, it will last up until the next audit at which time the people responsible for this decision will be forced to recant and if they don't have the word "chief" in their title, they'll probably be fired.

  • Can you impliment a secureId type solution? Person carries a token that identifies themselves to the system. This isn't perfect security, but it is a step above no passwords, and for high security needs is a part of the solution. These can be lost too, but that is a slightly different problem, so you might find it happens less often.

    Have you looked at bio type ids? (fingerprint or eye scan?) these are not very good yet, but might be good enough.

    Last, ask why users are forgetting thier passwords. I find that when I log onto a system every day I don't forget the password. This even if it changes fairly often. Perhaps you need to impliment a system where all passwords are always in sync so that users only have one password to remember.

    Maybe you need to keep statistics that better reflect what is happening. It doesn't sound like your problem, but a small number of password resets is normal, but small when you have a lot of people around can still be a large number out of context.

  • There have already been some great posts about questions to ask ("You don't need a password? Do you lock your car"?) policy to set ("have to fill out a form and walk it to IT to have the password changed"), but I have two additional suggestions:

    Have you considered billing back use of the outsourced helpdesk to the other departments? Hit them in the wallet, and in doing so they need to fill out paperwork everytime they want a password changed. No writing them down either - that should be grounds for termination.

    If not, maybe you need to consider either biometrics or access cards. You could replace password auth with smart card auth, and if they lose it they need to report it immediately or they really will get fired.

Slashdot Top Deals

The one day you'd sell your soul for something, souls are a glut.

Close