Password Security?
-
@Dashrender said:
But for my own piece of mind, and the fact that logs are really difficult to fake (destroy - sure, fake - not so much) I wouldn't do it.
I might be tempted to do it in a shop that is too small for AD. It really is tempting to do. I understand the desire to do it. But only with really good policies and communications with people and only if the company generates the passwords. Once you have AD, though, I would not want to do it.
Moving to something like Chromebooks you would be even less likely to do it.
-
I've provided evidence of user misuse of company systems during disciplinary proceedings but in all cases the user admitted guilt when presented with the evidence. I'm not sure what would happen if they claimed that I could have used their credentials to frame them. I'm not sure that would stand up as a valid defence in a court of law. I just don't think the "but the IT guy could've done it" sounds like a strong defence. But I'm no lawyer. I'd be interested to hear some real life examples.
We do have a problem here with users giving other users their passwords. It's against company policy, but I know it goes on. I try not to get too involved as it's primarily an HR issue, not an IT issue. Mainly I try and point out to users what might happen if someone used their credentials to commit something illegal, in the hope that I can scare them into better behavior. But no-one seems to care apart from me.
I'm always amazed when users come up to me and say things like "Bob is on holiday, can you log on to his machine for me so I can check if he had an e-mail from X last week". Er...no.
-
@Carnival-Boy said:
I've provided evidence of user misuse of company systems during disciplinary proceedings but in all cases the user admitted guilt when presented with the evidence. I'm not sure what would happen if they claimed that I could have used their credentials to frame them. I'm not sure that would stand up as a valid defence in a court of law. I just don't think the "but the IT guy could've done it" sounds like a strong defence. But I'm no lawyer. I'd be interested to hear some real life examples.
Manipulating the logs would be "but the IT guy could have done it." Requiring that you have full identity ownership on par with their ownership of it means that you are an equally culpable party. That's a bit different. Any evidence against them based on their account would be equally against you. You are not an "outside chance", but every bit as much of a primary holder of the identity.
I would say that it is more than a strong defense. It completely eliminates any reason to assume that it was the person whose name was assigned to the account. It is the difference between the account being just a name and it being an identity.
If you have other evidence or users who are idiots or who just want to get caught, then you are fine. But if you are counting on an identity system that is not at all an identity system, then there is really nothing.
Where is the line between this and creating accounts for people who don't even work there or who are never told their passwords? You could do unlimited actions on their behalf. I'd say that the opposite is true - claiming that assigning a username that looks like a human name is a weak defense compared to who owns and controls the account and its password.
-
@Carnival-Boy said:
We do have a problem here with users giving other users their passwords. It's against company policy, but I know it goes on. I try not to get too involved as it's primarily an HR issue, not an IT issue. Mainly I try and point out to users what might happen if someone used their credentials to commit something illegal, in the hope that I can scare them into better behavior. But no-one seems to care apart from me.
That's a problem too, but I find it surprising that you point out the legal issues of it when they hand it out and not when you require it to be shared. This is the pot calling the kettle black. You are admitting to them that there is a security problem and telling them not to do it while you are doing it to them already. No wonder they don't take heed. Your actions are speaking louder than your words. I agree that it is an HR issue, but I think employees would wise up and point out that any HR policy against such a thing violates IT's policy and that management needs to sort out its confusion before making staff do one thing or another.
You try to scare them yet when we pointed out the risk in this thread, you dismissed it. Why do you dismiss it with you sharing their passwords and not with them sharing with each other?
-
@Carnival-Boy said:
I'm always amazed when users come up to me and say things like "Bob is on holiday, can you log on to his machine for me so I can check if he had an e-mail from X last week". Er...no.
It's only so surprising since they know that you have his password and can do that. It's not surprising that you won't do it, but for them to assume that that is a primary reason for why you keep his password is not really much of a stretch.
-
@scottalanmiller said:
@Carnival-Boy said:
I'm always amazed when users come up to me and say things like "Bob is on holiday, can you log on to his machine for me so I can check if he had an e-mail from X last week". Er...no.
It's only so surprising since they know that you have his password and can do that. It's not surprising that you won't do it, but for them to assume that that is a primary reason for why you keep his password is not really much of a stretch.
Also, while this is outside the scope of this conversation, why didn't Bob setup someone to have access to those emails, or put rules in place, etc to allow things to be taken care of during his absence? (short of unexpected illness)
-
@scottalanmiller said:
It's only so surprising since they know that you have his password and can do that. It's not surprising that you won't do it, but for them to assume that that is a primary reason for why you keep his password is not really much of a stretch.
You're confusing users with domain administrators. I have access to all company data because I'm the IT manager. Users don't because they're users. There's a very clear distinction. You're treating them the same.
-
@Dashrender said:
Also, while this is outside the scope of this conversation, why didn't Bob setup someone to have access to those emails, or put rules in place, etc to allow things to be taken care of during his absence? (short of unexpected illness)
This is what annoys me. I go to a lot of effort to make sure everything is covered when I go on holiday, yet other managers do nothing when they go away (out of laziness in all probability). Yet when the shit hits the fan, I'm expected to sort everything out. I have to organise my own holidays and everybody elses.
Sorry, rant over.
-
@Carnival-Boy said:
@scottalanmiller said:
It's only so surprising since they know that you have his password and can do that. It's not surprising that you won't do it, but for them to assume that that is a primary reason for why you keep his password is not really much of a stretch.
You're confusing users with domain administrators. I have access to all company data because I'm the IT manager. Users don't because they're users. There's a very clear distinction. You're treating them the same.
Am I? In what way? They know that you have the user's password. They want you to act as the user. What does this have to do with the domain admin?
-
@Carnival-Boy said:
@Dashrender said:
Also, while this is outside the scope of this conversation, why didn't Bob setup someone to have access to those emails, or put rules in place, etc to allow things to be taken care of during his absence? (short of unexpected illness)
This is what annoys me. I go to a lot of effort to make sure everything is covered when I go on holiday, yet other managers do nothing when they go away (out of laziness in all probability). Yet when the shit hits the fan, I'm expected to sort everything out. I have to organise my own holidays and everybody elses.
Sorry, rant over.
Yeah, not exactly fair. HR should keep that on a more even keel. But, bottom line, you are probably more critical than normal staff.
-
@scottalanmiller said:
You try to scare them yet when we pointed out the risk in this thread, you dismissed it. Why do you dismiss it with you sharing their passwords and not with them sharing with each other?
I'm not dismissing anything. I started this thread saying I'm seeking to be proven wrong. I'm skeptical of the legal risks and since none of us are legal experts or have any real world examples, I remain skeptical.
What I do know of the law (mainly learnt through reading John Grisham and watching Law & Order) is that a defence has to be not only technically possible but credible. It's possible, for example, that the IT Manager logged on to your PC and downloaded loads of porn, but is it credible?
Answer me this, why is the defence "the IT Manager knows my password because I told him it therefore he could have done it" acceptable, but "the IT Manager knows my password because he used a brute force attack to find out what it is" not acceptable? Both are technically possible. I've seen penetration tests where user passwords are discovered in like 5 minutes.
-
@scottalanmiller said:
@Carnival-Boy said:
@scottalanmiller said:
Why is the domain admin password written down? Is this a break-glass system for turning over admin access to a third party?
Essentially, yes. I've read tons of stories of networks getting compromised, usually as part of a penetration test. I haven't actually done a pen test here, but I've no doubt that our network could get compromised. What I haven't heard though, is networks getting compromised via a Keepass database (or similar password management tool). Those products seem pretty robust. That doesn't appear to be the weak link in our security.
Keepass is pretty secure. But how it is used is what matters. Are you the only one with access to it? If so, isn't that a point of fragility? If not, that's a lot of password exposure. Are you confident that no one is writing down the Keepass password?
Keepass is great, I just wouldn't keep the one master domain password there.
I keep a few passwords in the one I maintain. The break-glass plan as you put it earlier for me is a sealed envelope in a fireproof save that I check regularly. Even has a break seal attached so I know if it's been used without my knowledge.
-
@Carnival-Boy said:
How does your break-glass system work? I'm not sure whether it's a good idea to publish my security policy on a public forum, but sod it. I may delete this post in a couple of days:
I have 3 Domain Admin accounts. One is for my use. One is used by our MSP (which they write down, I don't know where they write it down exactly), and one is for emergency use (eg I get run over by a bus). The emergency one is stored in Keepass. Two other people have access to the Keepass database, and the Keepass password is written down (yes, it is written down!) and stored in the safe.
I used to just store the Domain Admin password in the safe, but it occurred to me that we have lots of other accounts that would be a real pain to recover if I ever disappeared. So it seemed better to just give my emergency users access to my Keepass file - that way they have everything.
If you use your attorney (as in your example), how do they remember the password without writing it down?
The Domain Admin accounts are configured to e-mail me whenever they are used, so if they are ever used when I'm not expecting them to be, it immediately arouses my suspicion and I may go into lock-down mode.
I'd be interested in any improvements to this. I don't like writing anything down, but I just haven't figured out a way of working without it (yet) and nothing on this thread has so far demonstrated how I can get away without writing anything down.
I sort of do this as well, but the KeePass credentials are not the same as the network / domain passwords. That info the person whom is instructed to open the fireproof box does not know until they break the seal on the envelope to obtain the most recent password for that KDB file. And that password is even changed every couple of months.
-
@scottalanmiller said:
Am I? In what way? They know that you have the user's password. They want you to act as the user. What does this have to do with the domain admin?
Best example I can think of - I'll give my banking details to my bank manager, but I wouldn't give them to my neighbor. I trust my bank manager with my bank details because that's kind of his job - to protect my money.
I'd also expect my boss to keep a close eye on me, as the keeper of data, for good governance. I don't expect him to have the same level of oversight with users, because they should have less access. The company knows I have access to all company data, and they mitigate the risks accordingly.
-
@Bill-Kindle said:
That info the person whom is instructed to open the fireproof box does not know until they break the seal on the envelope to obtain the most recent password for that KDB file. And that password is even changed every couple of months.
Same here.
-
Who down voted my post? I'm only kicking round a few ideas here, saying what I do, and trying to pick up a few tips on how I can improve. I'm not out to piss anyone off. There's no need for down voting, surely?
-
@Carnival-Boy said:
Who down voted my post? I'm only kicking round a few ideas here, saying what I do, and trying to pick up a few tips on how I can improve. I'm not out to piss anyone off. There's no need for down voting, surely?
Wasn't me. Does the activity feed tell you? I see when people upvote. Never paid attention but I bet downvotes are there too.
-
@Carnival-Boy said:
@scottalanmiller said:
Am I? In what way? They know that you have the user's password. They want you to act as the user. What does this have to do with the domain admin?
Best example I can think of - I'll give my banking details to my bank manager, but I wouldn't give them to my neighbor. I trust my bank manager with my bank details because that's kind of his job - to protect my money.
I'd also expect my boss to keep a close eye on me, as the keeper of data, for good governance. I don't expect him to have the same level of oversight with users, because they should have less access. The company knows I have access to all company data, and they mitigate the risks accordingly.
Okay, I'll agree with that. Not sure about the bank manager bit, but the boss and oversight bit. A bank manager has strict monitoring and regulations that oversee him because they don't really trust him either. But that you are viewed as a risk and monitored extra because of that makes some sense.
-
@Carnival-Boy said:
What I do know of the law (mainly learnt through reading John Grisham and watching Law & Order) is that a defence has to be not only technically possible but credible. It's possible, for example, that the IT Manager logged on to your PC and downloaded loads of porn, but is it credible?
Very credible if the business wanted someone fired and needed a reason. Is it credible to think that someone would do that at work? They do, but it's pretty crazy.
If the goal is to commit a crime (steal money, defame a third party, etc.) using someone, anyone, else's identity can be very useful. It depends on the end action, surely. But in the US, at least, the difference between an account being an "identity" account and it being a "shared" account is pretty big. In this case, that's not "his" account but it is an account that he shared equally with you.
-
@scottalanmiller said:
In this case, that's not "his" account but it is an account that he shared equally with you.
Absolutely not the same thing at all. But if you're going down that route then your statement applies to every time the IT guy logs in as the user. Resetting the password makes no difference, you're still logging in as that user. The "IT guy did it" defence simply becomes "the IT guy must have reset my password, logged in as me, done the deed, then reset my password".
Every time any support guy makes a desktop sharing session to do some work he is technically logged in as that user.
