Passwords and the Human Factor

Passwords have a strange dual nature. The stronger and safer the password the more likely it will be undermined by human weakness.

It is widely known that passwords are the most common means of access control. It is also common knowledge that passwords are the easiest way to compromise a system. Passwords have two basic functions. First, they allow initial entry to a system. Next, after access, they grant permission to various levels of information. This access can range from public data to restricted trade secrets and pending patents.

The best passwords are a lengthy and complex mix of upper and lower case letters, numbers and symbols. The tendency for people when using these formats is to write them down, store them on a hand held device, etc. thus destroying the integrity of the password.

The integrity of passwords can be circumvented through "Human Engineering." People can unwittingly make grave errors of judgment in situations that they may view as harmless or even helpful. For example, a password is shared with a forgetful employee and a system can be compromised. In more ominous cases, a con artist or hacker can phone a naïve employee and present themselves as senior executives or help desk personnel and obtain that persons password. People have also been duped by callers claiming emergencies, cajoling or even threatening the employees job if a password is not provided.

These human lapses can be addressed through employee training and written policies that provide solid guidance and procedures in these circumstances. Training in information security, including password protocols, should be mandatory for every employee of the enterprise. Management support of this training and the security policy is critical to its success. To be effective, training should be repetitive with quarterly reviews of the company policy. There can also be frequent reminders, such as banners, about password security that appear during logons.

Management must not only support security measures, they must also provide a written and enforced policy statement. These written policies should be developed with assistance from the I.T. department as well as the human resource and legal departments. Written policies should be a part of the employee's introduction to the company and should be reviewed at least twice a year. It is also critical that the employee sign off on the document indicating that they received, read, and understood its contents. Firms that ignore these practices do so at their own risk.

Enforcement is an important partner to training. A policy that is not enforced is far worse than no policy at all. In fact, haphazard enforcement or lack of enforcement can increase a company's liability in many legal actions. To work, a policy must have "teeth". There should be a range of consequences for lapses whether it is a single event or multiple or flagrant incidents. This can range from a verbal warning all the way to termination.

In summary, passwords can be kept more secure by recognizing the human factor. Through management initiative, communication and training, as well as written and enforced policies and procedures, companies can have more control over their information assets and keep their clients and partners much safer.

About The Author

Terrence F. Doheny

President, Beyond If Solutions,LLC

www.beyondifsolutions.com

terry@beyondifsolutions.com

PC World
Walt Mossberg to Appear Weekly on FOX Business Network in a ...
Business Wire (press release), CA - 21 hours ago
In making the announcement, Magee said, “Walt is the most well-respected personal technology reporter in the industry, and his insights on new products not ...
Fox Business Snatches WSJ's Walt Mossberg From CNBC Silicon Alley Insider
Walt Mossberg to Join Fox News: What? PC World
Walt Mossberg and the Fox-Journal-CNBC Loophole Conde Nast Portfolio
all 19 news articles

Computerworld
Tech giants unite to thwart web hijack risk
Times Online, UK - 3 hours ago
Microsoft released its patch yesterday as part of it regular patch schedule, and automated updating should protect most personal computers. ...
New flaw could let hackers control web Australian IT
New ‘security patch’ software tackles major internet security breach News Locale
all 209 news articles

Broadband Indiscretions
Forbes, NY - 15 hours ago
It's important to note that the Wiretap Act was created before the advent of personal computing and online communications and was written to apply to phone ...

NAF Institute for Staff Development Workshop Focuses on Use of ...
PR Web (press release), WA - 3 hours ago
Hands-on activities and technology resources give students an applied understanding of high school personal finance and economics. New York, NY (PRWEB) July ...

Management merry-go-round continues at tech startups
Ottawa Citizen,  Canada - 7 hours ago
The executive turnover at Ottawa technology startups is picking up. Natural Convergence said Patrick Smith is the new chief executive of the seven-year-old ...

How to best use Bluetooth technology in a small business
San Francisco Chronicle,  USA - 10 hours ago
Ultrawideband technology promises to offer personal-area networking (that's industry-speak for short-distance networking) capability similar to Bluetooth, ...

Washington Post Personal Technology Columnist
Washington Post, United States - Jun 26, 2008
Read transcripts of Rob's past tech discussions here. Rob Pegoraro: Welcome! My story today is about shooting things with a handheld device--no, ...

Malawi adopts high-tech banking, leapfrogs many countries
NetworkWorld.com, MA - 17 hours ago
Card users are allowed to authorize their transactions by scanning their fingerprints, an alternative to less-secure verification by PIN (personal ...

Personal tech briefs: Game-to-film trend continues
Salt Lake Tribune, United States - Jun 24, 2008
The TV uses stereoscopic technology called TriDef from DDD Group Plc in Santa Monica, Calif., which works by sending the same image separately for the left ...

CNET News
DreamWorks selects Intel tech
ITWeb, South Africa - 6 hours ago
Intel, whose biggest rival is Advanced Micro Devices, said it also plans to develop next-generation 3D viewing technology for home theatres, personal ...
Studio Chooses Intel for Chip Pact Wall Street Journal
DreamWorks and Intel Join To Power 3-D Filmmaking Sci-Tech Today
all 281 news articles

Wind Chimes and more...

Windchimes for great gifts!

Consumer Electronic Information: The Basics of the DLP Projector