in Blog

Some Things Never Change In Password Security

When you’re a security pro, there are a lot of conversations you’re accustomed to having over and over. There’s the “Yes, we should have the business review and approve security policy” conversation. The classic “No, we can’t just give everyone all access to the share to make your life easier.”

There are some conversations, however, that most of us feel are already said and done. With all the breaches in the headlines that talk about stolen passwords, you would think the notion that passwords must be changed regularly is a pretty settled issue. I don’t expect someone to argue when I say “passwords should be changed regularly.”

If you’re planning to go to the UK any time soon, you may find yourself in the position of trying to argue about the need to change passwords all over again. Recently the CESG, the Communications-Electronics Security Group – a group within the UK Government Communications Headquarters (GCHQ) – issued a new advisory titled “The problems with forcing regular password expiry.” In it they argue that the “usability costs” of password expiry result in more trouble than they’re worth. The summary of their argument is:

[su_quote]The new password may have been used elsewhere, and attackers can exploit this too. The new password is also more likely to be written down, which represents another vulnerability. New passwords are also more likely to be forgotten, and this carries the productivity costs of users being locked out of their accounts, and service desks having to reset passwords. It’s one of those counter-intuitive security scenarios; the more often users are forced to change passwords, the greater the overall vulnerability to attack.[/su_quote]

Where to begin? Let’s start with where they are right. People using the same passwords for multiple accounts is a problem. People writing passwords down or user fatigue with password management as an excuse to justify weak passwords are big issues. Simple passwords get cracked more easily, and when people reuse passwords a hack on your favorite dog food delivery service means they have a password that exposes corporate data.

So, it’s not like they are completely out in left field. It’s begs the question: are these reasons enough to say we should throw out the idea of changing passwords? I bet you can guess my answer.

Not All Passwords Are Created Equal

The first thing that struck me when I started to read this advisory was that they were going to transition to advice about using multi-factor authentication or other one time, device, or contextual methods to authenticate users. As I read down to the bottom I was very surprised they didn’t.

It seemed to me that advice advocating users not to change passwords must have been some gimmick to get them to buy into stronger authentication. When I realized it wasn’t, I was pretty sure I had missed something so I went back and read it all over again.

On the second reading, the other big problem hit me. They made no real distinction about the kind of passwords they were talking about. If you limit the discussion to user passwords, then maybe there’s enough to their case to have a discussion. When you include the scope of administrative, system, service, and other types of accounts, then there‘s no discussion at all.

It seems like the context is there to limit what they say to end users, but not saying that explicitly makes this advice very dangerous. It’s entirely possible that small shops with very little dedicated IT could take this too much to heart and start engaging in some very dangerous practices.

The proliferation of passwords for websites is the source of the fatigue for remembering passwords in most cases. When breaches expose lists of passwords online, the very first piece of advice you get is: change your passwords!

The real leaders like Google, Microsoft, and Apple have all adopted a multi-factor authentication method (which every smart user should enable immediately) in order to protect their users because they know passwords alone are not enough. This is one place organizations should be careful emulating the good that consumer technology has to offer, not just anything that seems cool.

CESG captures something very real in this advisory. When the only trick administrators had in their bag to secure passwords was forcing them to be long, complex, and constantly rotating, we learned that this seemingly sound practice could lead to very bad results as CESG describes.

There is room for easing the policies on how often you change passwords for end users, but that needs to be done in concert with things like codes sent to phones to secure tricky operations like the big boys on the consumer side.

Most of all, users must be educated about the line between work and home life in technology. Changing passwords at home is a chore you can skip at your own risk. Changing passwords at work is a responsibility that is a thin line which often stands between us and the bad guys getting our organization’s data.

There are ways to copy the consumer side to advance, but take from the best – not from the rest.

Write a Comment

Comment

117 Comments

  1. I like what you guys tend to be up too. This type of clever
    work and coverage! Keep up the wonderful works guys I’ve included you guys to blogroll.

  2. Hey there! Someone in my Facebook group shared this website with us so I
    came to look it over. I’m definitely loving the information. I’m book-marking and will
    be tweeting this to my followers! Outstanding blog and amazing design and style.

  3. I rarely comment, but i did a few searching and
    wohnd up here Some Things Never Change In Password Security – PrivacySniffs.

    And I actually doo have a couple of questions for you if
    it’s allright. Is it only me or does it seem like a few
    of the comments come across like coming from brain dead individuals?
    😛 And, iif you are writing at additional online sites, I
    would like to keep up with everything new you have to post.

    Would you make a list oof every one of all your communal pages like your linkedin profile, Facebook page or twitter feed?

    Also visit my webpage – vein clinic Aurora

  4. Hello there, I found your blog by the use of Google whilst searching for a related matter, your site got here up, it looks great.

    I’ve bookmarked it in my google bookmarks.[X-N-E-W-L-I-N-S-P-I-N-X]Hi there, just become aware of your blog through Google, and
    located that it is truly informative. I’m going to be careful for brussels.
    I will appreciate in case you proceed this in future.
    Many other folks can be benefited from your writing.
    Cheers!

    Also visit my website: 直接访问

  5. What i do not understood is in reality how you’re no longer
    actually a lot more smartly-appreciated than you might be now.
    You’re so intelligent. You understand therefore significantly with regards to this topic,
    made me in my opinion believe it from a lot of varied angles.
    Its like women and men aren’t interested unless it is one thing to accomplish with Girl
    gaga! Your personal stuffs nice. Always care for it up!

    my page: Intelle Brain Review

  6. excellent put up, very informative. I’m wondering why the other specialists of this sector don’t understand this.
    You should continue your writing. I’m sure, you’ve a huge readers’ base already!

    Feel free to surf to my blog post … Keto XR Reviews

  7. Hello there, just became alert to your blog through Google,
    and found that it is truly informative. I’m going to watch out for brussels.

    I’ll appreciate if you continue this in future.
    Lots of people will be benefited from your writing.
    Cheers!

    Also visit my site: https://onlyfullmovies.com/groups/weed-and-wisdom-finest-cannabis-quotes-922972051/

  8. Hello! I’ve been following your weblog for a while now and finally got the
    courage to go ahead and give you a shout out from
    New Caney Tx! Just wanted to say keep up the good job!

  9. I like the valuable info you provide in your articles.
    I will bookmark your weblog and check once more here regularly.
    I’m fairly certain I’ll learn many new stuff proper right here!

    Good luck for the next!

  10. I appreciate, cause I discovered just what I was looking for.
    You have ended my four day lengthy hunt! God Bless you man. Have a great day.
    Bye

  11. Hey there would you mind letting me know which webhost you’re using?
    I’ve loaded your blog in 3 completely different web browsers and
    I must say this blog loads a lot quicker then most.
    Can you recommend a good hosting provider at a honest price?
    Kudos, I appreciate it!

  12. excellent put up, very informative. I’m wondering why the opposite experts of this sector do not realize this.
    You must continue your writing. I am confident, you’ve
    a huge readers’ base already!

  13. I have been browsing online more than 3 hours today, yet I never found
    any interesting article like yours. It’s pretty worth enough for me.
    Personally, if all webmasters and bloggers made good content as
    you did, the net will be a lot more useful than ever before.

  14. Amazing blog! Do you have any hints for aspiring writers?

    I’m hoping to start my own site soon but I’m a little lost
    on everything. Would you suggest starting with a free
    platform like WordPress or go for a paid option? There are so many options out there that I’m totally confused ..
    Any recommendations? Kudos!

  15. Thanks for one’s marvelous posting! I truly enjoyed reading it,
    you might be a great author.I will always bookmark your
    blog and will often come back in the future. I want
    to encourage yourself to continue your great posts, have a nice weekend!

  16. This is ver interesting, You are a very skilled blogger.
    I have joined your rss feed and look forward tto seeking more of your greaat post.
    Also, I’ve shared yur website inn mmy social networks!

    Also visit my site :: Jarrod

  17. I think everything published made a great deal of sense.
    However, think about this, what if you were to create a killer post
    title? I am not suggesting your content is not solid., however what
    if you added a post title that grabbed folk’s attention? I mean Some Things Never Change In Password Security – PrivacySniffs is
    kinda vanilla. You might look at Yahoo’s home
    page and see how they create article headlines to get viewers to click.
    You might add a video or a pic or two to get readers excited about everything’ve got to say.
    In my opinion, it might make your website a little livelier.

  18. Greetings! I’ve been reading your web site for some time now and finally got the bravery to go ahead and give
    you a shout out from Dallas Tx! Just wanted to tell you keep up the fantastic work!

  19. You could definitely see your skills within the work you
    write. The sector hopes for more passionate writers
    such as you who are not afraid to say how they believe.

    All the time follow your heart.

  20. Whats up very cool blog!! Guy .. Beautiful ..
    Amazing .. I’ll bookmark your web site and take the feeds additionally?
    I am happy to find so many helpful information here within the
    put up, we need develop more strategies in this regard, thank you for sharing.

    . . . . .

  21. Hello just wanted to give you a quick heads up.
    The words in your article seem to be running off the screen in Opera.
    I’m not sure if this is a format issue or something to do
    with web browser compatibility but I figured I’d
    post to let you know. The design look great though!
    Hope you get the issue resolved soon. Kudos

  22. One should please remember the prospective customer with his
    fantastic views towards a certain style, prior to buying the item of furniture from the store.
    Our lives are filled up with stress and countless responsibilities that could
    be overwhelmingly hectic at times. It is also important to get in the habit of regular exercise to take care of muscle strength and prevent obesity.

  23. One should also keep in mind the mark customer with his fantastic
    views towards a specific style, prior to buying the furnishings in the store.
    With the help of these oils, you feel more relax within a massage.

    A well designed Rehabilitation program with the correct growth of proper
    stretching exercises will mean these basic functions can be preserved and improved
    upon.

  24. Attractive element of content. I just stumbled upon your web site and in accession capital to assert that I get actually
    loved account your blog posts. Any way I will be subscribing to your augment and even I fulfillment you get right of entry to
    consistently rapidly.

  25. Hey! Do you know if they make any plugins to assist with
    SEO? I’m trying to get my blog to rank for
    some targeted keywords but I’m not seeing very good
    gains. If you know of any please share. Kudos!

  26. It does not take a whole day to attend a massage session and you can schedule your appointments yourself, making it possible to fit it even into
    the busiest day. Our lives are filled with stress and countless responsibilities that can be overwhelmingly hectic at times.
    This is for the objective of easy gliding of the hand of the massage
    therapist around the parts that should be caused consistently.

    Feel free to visit my blog – 탑텐출장안마

  27. It does not please take a whole day to attend a massage session and you may schedule your
    appointments yourself, making it possible to fit it even to the
    busiest day. Sometimes it is almost cuddling, spending some time together, hugs and kisses.
    Individuals seeking to be a certified massage therapist will likely need to
    complete a thorough educational training program.

  28. One should also remember the target customer and the views towards a particular
    style, before selecting the furniture of the store. With the help of
    these oils, an individual will feel more relax after a massage.
    A well designed Rehabilitation program while using correct advancement of proper stretching exercises will mean these basic functions might be preserved and improved upon.

    Feel free to visit my blog post; 탑텐출장안마

  29. Piriformis trigger points tend to be confused to get
    a herniated disc, sciatica, or another back issues, and many sufferers undergo unnecessary and expensive tests, injections, and surgeries.
    This is why we now have other friends and acquaintances together with family members and relatives.
    Molten lava flows from nearby, Volcano National Park to
    satisfy the sea in a convulsive spray of embers and billowing steam.

    Here is my homepage :: 죠스출장마사지

  30. Hmm it appears like your website ate my first comment (it was super long) so
    I guess I’ll just sum it up what I wrote
    and say, I’m thoroughly enjoying your blog. I as well am an aspiring blog
    blogger but I’m still new to everything. Do you have any recommendations for
    inexperienced blog writers? I’d genuinely appreciate it.

  31. Today, I went to the beach front with my children. I found a sea shell and gave it
    to my 4 year old daughter and said “You can hear the ocean if you put this to your ear.”
    She placed the shell to her ear and screamed. There was a hermit crab inside and it pinched her ear.

    She never wants to go back! LoL I know this is totally off topic but I had to tell someone!

  32. You may need to place a tiny towel through your feet during
    the massage to prevent spilling the oil onto
    your clothes or bedding. Our lives are full of stress and countless responsibilities that can be overwhelmingly hectic
    at times. It is a thing that we highly recommend that couples do before they’ve problems.

  33. The main need for such a type is giving moisture for the skin and relaxation from the body.
    With the help of these oils, you feel more relax within a massage.
    It is something which we strongly suggest that couples do before they have problems.

  34. It does not have a whole day to attend a massage session and you will schedule your
    appointments yourself, making it possible to
    fit it even in the busiest day. The chair is constucted from such leather which is very comfortable and warm and so, you’ll feel comfortable with it.
    A well designed Rehabilitation program with the correct growth of proper stretching exercises means these basic functions could be
    preserved and improved upon.

    Here is my blog post :: 출장마사지

  35. Thank you for every other fantastic article.
    Where else may just anybody get that kind of info in such a perfect method
    of writing? I have a presentation subsequent week, and I am at the look for such information.

  36. This includes fancy graphics, logos, letter heads and the appearance and feel of your marketing material.
    Bathtubs don’t come cheap, so it really is very advisable to compare in order that you get real value on your money.
    They believe that after these oils are utilized inside a massage,
    these are forwarded to the actual organs or systems
    from the body where they increase the natural functions of those organs.

    Also visit my page … 출장마사지

  37. Piriformis trigger points tend to be confused to get a herniated disc, sciatica, and
    other back issues, and many sufferers undergo unnecessary and expensive tests, injections, and surgeries.
    This is why we now have other friends and acquaintances as well as members of the family and relatives.
    The word massage is most likely to have emerged in the Greek word ‘Massein’, meaning ‘to knead’ or Arabic word ‘mash’ meaning ‘to press softly’.

    My page; 출장안마

  38. The therapist must have advanced training and experience with treating soft tissue
    injuries. Our lives are filled up with
    stress and countless responsibilities that could be overwhelmingly hectic at times.
    A well designed Rehabilitation program with the correct continuing development of proper stretching exercises means these basic functions can be preserved and
    improved upon.

  39. A chiropractic treatment involves manual therapy,
    exercises and health and lifestyle counseling.
    If the methods that have been outlined here fail out for
    you personally, then its recommended that you seek the
    audience of the qualified health professional. The word massage is
    probably to get emerged through the Greek word ‘Massein’, meaning ‘to knead’ or Arabic word ‘mash’ meaning ‘to
    press softly’.

    Review my blog post :: 출장마사지

  40. It does not require a whole day to attend a massage session and you’ll schedule your appointments yourself, making it possible to
    fit it even to the busiest day. With the help of these oils, an individual will feel more relax throughout a massage.
    Individuals seeking to turn into a certified massage therapist will likely need to develop a thorough
    educational training program.

  41. One should also remember the mark customer and his awesome
    views towards a certain style, before choosing the furniture of the store.

    With the help of these oils, you will feel more relax throughout a massage.

    A well designed Rehabilitation program while using correct continuing development of proper stretching exercises will mean these basic functions can be preserved and improved upon.

  42. Hmm it seems like your site ate my first comment (it was super long) so I guess
    I’ll just sum it up what I submitted and say, I’m thoroughly enjoying your blog.
    I too am an aspiring blog blogger but I’m still new to everything.
    Do you have any recommendations for first-time blog writers?

    I’d really appreciate it.

    my blog nipple clamps toys

  43. Baby massage ‘s been around for hundreds of years but is quickly regaining
    it’s popularity in America. Now you start to massage your ears;
    start taking the surface of your ears, then massage hard all way down the ear.
    This is for the purpose of easy gliding with the hand with the massage
    therapist around the parts which needs to be worked with consistently.

  44. Following a simple baby massage routine offers you both exclusive one-on-one some time and really gets
    you in tune along with your baby as well as providing you with more confidence in handling
    them. If the methods that have been outlined here fail out to suit your needs, then its recommended
    that you seek the viewers of your qualified health professional.
    Molten lava flows from nearby, Volcano National Park to meet the sea
    inside a convulsive spray of embers and billowing steam.

    My web-site … 출장마사지

  45. This includes fancy graphics, logos, letter heads and also the feel and look of your marketing material.
    We have to think about though that regardless of whether these stones are exceptional in relation to maintaining heat and works magnificently when talking about hot stone massage, marble stones hold the tendency to be a better tool for
    clients in relation to this therapy. Molten lava flows from nearby, Volcano National Park to
    meet the sea in a convulsive spray of embers and billowing
    steam.

    Feel free to visit my page … 죠스출장안마

  46. One should please remember the prospective customer and his views towards a certain style, before choosing the item of
    furniture in the store. The chair is made from such leather which
    is very comfortable and warm so, you will feel relaxed with it.

    This is for the purpose of easy gliding with the hand with the massage therapist on the parts
    that needs to be dealt with consistently.

    Feel free to surf to my webpage – 탑텐출장

  47. You may desire to place a small towel through your feet throughout the massage
    in order to avoid spilling the oil onto your clothes or
    bedding. With the help of these oils, you feel more relax within a massage.
    A well designed Rehabilitation program with the correct progression of proper stretching exercises will mean these
    basic functions can be preserved and improved upon.

  48. One should also remember the target customer and his views towards a particular style, prior to you buying the furniture of the store.
    You can download MP3 files on top of the USB
    stick and plug it into the port found on the chair.
    Individuals seeking to be a certified massage therapist will need to finish a thorough
    educational training program.