Your password for a rubber bone!

Attila Kiss - marketing manager

While we pay too much attention to network security and data security problems, we often forget that technology is no longer such a high risk as the users themselves. Even if we have successfully introduced the best security systems, we cannot stop there, since we also have to train users actively so that they become more security conscious. In this article, we will talk about a nearly out-of-date and forgotten but the most widely used security tool in the world: the password.
What is the problem with it? Mainly, that there are a lot of them. Or, at least, there should be a lot of them. Today, I have counted the number of passwords I had to use from waking up until typing of this article. it was 15.
Waking up: telephone PIN, SIM card PIN. Morning shopping: bank card PIN. Arrival at workplace: alarm PIN, operational system PIN, (office and private) e-mail password, chat passwords (MSN, GTalk, ICQ, Skype). Password for the intraweb, the online bank, the CRM and it is only now that I can get to work.

Of course, one starts to have defensive reactions. The PIN code of the telephone, of the SIM card and all bank cards are the same as the four digit code of the company’s alarm. If it weren’t like this, I should write it down, which equals to an unacceptable security risk, since in this way the telephone, bank cards and their PIN codes could be found together in my bag. If I did not write them down, I would always forget the least often used ones. Thus, the best solution is that they are the same.

Others go even further and they generate passwords themselves from easily accessible data like birthdays or ID-card numbers.

Well-trained company network administrators of course do not like these strategies and create rules concerning company passwords. Let’s see what effect these rules have on IT security.

Insistence on strong passwords
If one faces a password type Mx45gKww6, the first reaction is to put it down somewhere. There are typical places where only a non-professional password-stealer would not find it. This is for example a post-it stuck onto the back of the keyboard, on which the password is wilily written in the reverse order.

Single Sign On
As a response to this strategy, the administrator introduces the ease to log in to all systems of the company with one password. He only asks the employees not to write down this password but to try to memorize it.

One still writes it down
Our administrator takes notice of the fact that security has significantly decreased because of the Single Sign On since if a hacker gets one password, s/he can have access to all systems. That is why the administrator makes users change their passwords every 30 days. As a response, users start to write down these passwords again, which they put to another place they consider totally secure: for example the back of the table.

Critical systems
As a response, the administrator abolishes the 30-day regeneration of passwords but he excludes critical systems from the Single Sign On system. Therefore, one gets new and impossible to learn passwords for the most sophisticated and least often used systems that one writes down of course and puts it nearby where others would never find it. For example, on the bottom of a flowerpot.

One tells it to everybody
Supposing that our administrator achieves, with extraordinarily convincing force, that users have an adequately complicated password they will not write down anywhere since they succeeded in learning it in several weeks. From now on, what other password would a user provide on all websites than this one? Web-based mail? Chat software? Blog? Webshops? Company password will be good for all these purposes.

Nowadays, the best method of stealing passwords is to create an innocent web service that can be made available by registration. Users provide their passwords there voluntarily.
If tomorrow I got up intending to read the mails of my dog-lover colleague than in half an hour I would create a web site on dogs where I would promise a free rubber bone to anyone who registers. Having sent him the link, I would probably have access to his/her Gmail mailbox or maybe even to his/her online bank account in a few minutes. If I wanted to get money from his/her bank card, I would simply ask for a four-digit number instead of a password. What else would he use, if not his/her bank card Pin code?