Password Policies

[eCliPSe]

Any Administrator that does this should be fired and should not be allowed to work in the ITC industry again.

 

[Chevron]

So last week we get a notice that the companies password policy will change and this week it got implemented.

Today the help desk is flooded with calls for locked accounts.

So my new password will have to be ...

Lower and upper case with numbers and special characters and there should not be more then one of the same character next to each other (I think this is pretty standard). You may not have a password you have used before.

Our passwords expire every month (reminders start coming after 14 days grrrrr).

There is no way I will be able to remember a new password every month. Should I stick a post-it with my domain password to my monitor or maybe store it as a note on my cellphone? Is that not even less secure then just having me pick an easy to remember password?

</vent>

We have a similar policy at my workplace. I use:
Password!1
Password!2
Password!3

You get the idea

 

[eCliPSe]

you actually post your crappy password on a public forum??????

 

[b@nD]

Fingerprint scanner

Just an idea ........
How expensive are these individual fingerprint scanner things ( to attach to each workstation )
and
How secure are they ?

 

[b@nD]

Jesting .........

you actually post your crappy password on a public forum??????

Read between the lines
It seems that some forms of humor are lost on you
( Do you have a pit bull by any chance ? )

 

[DrJohnZoidberg]

Any Administrator that does this should be fired and should not be allowed to work in the ITC industry again.

Wow, fired? Really? I have set this policy on certain users a few times, depends completely on the situation.

 

[AlphaBravo]

Its killing me seeing the responses to the password policies. Those things are in place for a reason.
Did anyone stop to think that if something incriminating happened from your workstation that the password policy ensures *you* were the person using it? there are tons more reasons for complexity and changes.

Paranoid much...the cold war is over man. No big secrets or access to it from my workstation.

 

[eCliPSe]

:O

Its really scary what you people are writing here.

@ ZoidBerg

Say your company policy states that a password should be changed every 31 days. Then you make a change that doesnt comply with this policy. You and your company could be liable for the loss of PII if that account is used to gain access to the network.

So I know a few that will label such an act as gross negligence which is grounds for immediate dismissal.

@Everyone

Most of the data leaks these days has been because of a lax approach by IT Professionals with regards to security.

Using bad passwords and usernames without following proper best practices have made it a very vulnerable World we live in. We all have responsibilities towards each other to take information security a little bit more seriously.

Being ignorant towards threats and best practices because it is a small inconvenience doesn't justify the risk you are casually laughing about.

People here for the most part are well informed about the ICT industry but approaches security as an hindrance that you pass on to everyday users.

Be Safe PS i don't have a dog

 

[eCliPSe]

Just an idea ........
How expensive are these individual fingerprint scanner things ( to attach to each workstation )
and
How secure are they ?

Domain accounts still require usernames and passwords.

 

[Rocket-Boy]

:O

Its really scary what you people are writing here.

You thought that too?
Its all about liability and security. People moan at the admins due to security measures we put in place but the world ends when something goes wrong with their pc due to something they did. Those measures are normally to prevent them breaking things in the first place.

 

[Skywalker786]

I just change the last number in my password every time the server asks me to change it. Once I reach the 12th month I start from one again

+1

 

[Jimmeh]

I'm also in the IT sec business. It is sad when people become unemployed due to public or easy to guess passwords. Rather put some effort into remembering something "complicated" yet simple. Something like your first cars registration number + a normal word with an @ or ! in it will be easy to remember. Example: wh!teabc123GP

People seriously underestimate the things that their friendly colleagues will do to get an advantage in the corporate world.

 

[Wall]

I can't believe people are so lax about their passwords.