Home Messages Index
[Date Prev][Date Next][Thread Prev][Thread Next]
Author IndexDate IndexThread Index

Re: Passwords for System Critical Domain

  • Subject: Re: Passwords for System Critical Domain
  • From: Roy Schestowitz <newsgroups@schestowitz.com>
  • Date: Wed, 27 Jul 2005 08:20:05 +0100
  • Newsgroups: alt.os.linux.suse
  • Organization: schestowitz.com / Manchester University
  • References: <jn2hr2-j65.ln1@penne.houghi> <dc54ct$28ji$1@godfrey.mcc.ac.uk> <kvihr2-kf9.ln1@penne.houghi> <dc59s9$3lr$3@nntp.itservices.ubc.ca> <3kmvqjFug07oU2@individual.net> <HKGdnW5dbpV__HvfRVn-sw@rogers.com> <dc5oji$2eau$1@godfrey.mcc.ac.uk> <VqidnTx4IO-CNHvfRVn-1g@rogers.com> <penir2-s8r.ln1@penne.houghi> <dc6vc7$2p0c$1@godfrey.mcc.ac.uk> <hqkjr2-ov2.ln1@penne.houghi>
  • Reply-to: newsgroups@schestowitz.com
  • User-agent: KNode/0.7.2
houghi wrote:

> Roy Schestowitz wrote:
>>> There standard security measures will be sufficuient. If you make it
>>> more secure, you will make it less secure. Most docters are not computer
>>> savy and will start doing things in a simpeler way to go around the
>>> info.
>>
>> Not "less secure", but potentially less _accessible_, I think.
> 
> I should have elaborated. See below.
> 
>> My University-owned workstation has a root password that is known to the
>> IT staff. Now, if I had sensitive medical data, _then_ encryption would
>> be more justified. Quite frankly, the IT staff is rather
>> Windows-oriented, so I need never hesitate to put something like my Palm
>> data on here.
> 
> Docters, surgeons and any other medical staff are not more or less
> computer savy as the average officeworker. An example I myself noticed.
> My father had to go to hospital and the docter had to enter some things
> into the PC. The PC was windows machine with a terminal that connected
> to a AS400.
> 
> The docter clearly forgot his password and who do you think he needed to
> call to get that fixed? Now this was in the emergency place so more
> people would be using that `terminal` to enter data, so the standard
> "pasword on the monitor" was not possible.
> 
> A solutions that looks plausable is the USB key, but what happens when
> the docter forgets his USB key? I have known docters to forget the
> pagers they need when they are on 24 hour watch. They solve this by
> calling dispatch and tell them to call on their personal phone. These
> are things that do happen.
> 
> Now what happens whith people in offices is the same that will happen
> with people in hospitals, be they docters, surgeons or not. They will
> probabbly need to remember several passwords for several systems. What
> they will do is use easier passwords, write them down or any other less
> secure. This will be more active when they have to change their
> passwords on a regular basis.
> 
> I have yet to see a company that completely uses a clear and transparant
> passwordsystem wher the employee needed to remember just 1 password and
> with that got access to all he needed. We all know it is possible, and
> yet it does not happen.
> 
> In most companies I worked for I needed at least 5 passwords. In one
> very bad example they had me change my password for different systems on
> different timescales. One system weekly (due to Microsoft demands) one
> after 30 days, one after one month (wich is NOT the same) ond some other
> after 90 days or 3 months, I forgot. So what I did is what everybody di,
> I wrote my passwords down.
> 
> Had a discussion with the IT manager and he still tought it was safer
> the way he did it. In another place IT staff had a list of 20 (that I
> saw) passwords written down and in their wallet. The above are almost
> examples of security trough obscurity.
> 
> In theory it is possible that people only remember 1 password (wich
> changes every month or two months) and give privelages to that password.
> IT staff might need a second login (not root) for pure IT related stuff,
> including root stuff. The knwoledge of the rootpasword should be
> extremely limited to only a few people. IF somebody else needs it,
> because his login has not the correct rights, a closed container,
> envelope or whatever can be breached to read the passwords. Think
> launching of missiles. This should not happen more then perhaps once or
> twice per year.
> 
> Security is a serious matter, yet is amazes me how few
> people/companies/ITstaff really think about it first from the point of
> view from the user and second, do not look at password management at
> all. More passwords is NOT safer. More passwordchanges is NOT safer. (No
> passwords and no changes is also not really safe, don't misinterpret me.
> ;-)

I fully agree with it all. I loathe typical password management proecudures
and policies. I also mock the requirement to periodically change passwords,
which definitely is a result of people who left papers 'trails' around with
password they had written down. It all reminds me of the same BS tips like
toss computer plagued with spyware in the bin and buy a new one because
it's supposedly more cost-effective.

I personally keep one master password on my Palm and it is used to unlock
the... [counting... 11x12 accounts and PIN's + 9 mailing lists = 141
passwords/passphrases]...

Returning to the main topic, losing your USB is not much more likely than
forgetting your passwords. And has anyone considered memory loss, a comma
or death? Imagine yourself a deceased person whose car and home need a
password for access. Okay, I took it to the extreme. I admit that and I'll
stop...

I think biometrics are a better solution to the USB key solution. IBM are
implementing the first biometric authentication system and they do so on
Linux (
http://www.schestowitz.com/Vision/modules.php?name=News&file=article&sid=26
). Just make sure you don't lose a finger on your way to work... or grow a
mustache or whatever...

Roy

-- 
Roy S. Schestowitz
http://Schestowitz.com

[Date Prev][Date Next][Thread Prev][Thread Next]
Author IndexDate IndexThread Index