Blog

This XKCD comic is absolutely spot on.

As I’ve gone around to different businesses, consulting on IT and security policy, it has always been interesting to see the lengths that some companies will go to in the name of security. Although many business I’ve visited have absolutely no security policy, others have had policies so draconian it seemed like they didn’t even want their employees to be able to use their computers.

One of the most insane I’ve seen was a password policy that required 12 characters of 4 different types with resets every 15 days. It was for food services company that apparently thought they were the Department of Defense. Half of their employees must have been working the helpdesk to keep up with password problems.

Don’t get me wrong, companies need to have a solid security policy. That policy just needs to have some basis in reality. When businesses implement unrealistic security policy, they usually wind up less secure. Find a business with a super complex password policy and you’ll also find a ton of keyboards with password sticky notes underneath them. Employees will be so used to having to deal with password issues that they won’t think it’s odd when someone calls their desk asking for their current password so they can “migrate them to the new systems.”

I was recently working with a company that was forced to implement 30 day password expiration (down from 90 days, which I believe is fine for most businesses) due to the security policy of the company that acquired them. Once the policy was implemented, help desk calls skyrocketed (and have sustained at the new levels) and a large majority of employees now write down their passwords. How is that a better business practice? How is it more secure?

The common threat to password security isn’t someone cracking the password of Jim from Accounting. That’s too CSI, too Hollywood. What normally happens is Jim’s co-worker, Carol, gets annoyed at the company, decides she is going to print some fraudulent checks, and uses the password she knows is in Jim’s desk drawer to do it.

If the company allowed for the use of passphrases, Jim probably wouldn’t have written his password down. He’d be able to remember “IWASBORNINABASKET” or “HOTDOGSAREMYFAVEORITEFOOD”, both of which are harder for a computer to crack (Computers aren’t very good at natural language.) while being easy to remember.

To be fair, when security professionals started advising on the use of complex passwords, the IT security field was in its infancy. People were focused almost solely on the technological aspects of security and at the time, it was very hard for a computer to crack a complex password. I’ve been guilty of making these types of recommendations. But times have changed and the field is maturing. Security practitioners (at least the good ones) are now taking business process and human factors into consideration when they design policy. They are accounting for the speed of modern computers and the evolution of attacks.

In my opinion these changes aren’t happening fast enough. SOX and PCI auditors are still steering businesses into using non-sensical password policies and not enough people are pushing back. It’s a big change of philosophy for a lot of folks. If your IT staff is recommending a complex password policy, go talk to them about passphrases. Help them understand the business needs and the people factor. Alternatively, if you’re in IT and the business is asking you to implement a password policy that doesn’t make sense, educate them. Inform them of the flaws of traditional password policy.

If nothing else, these conversations will at least seed the idea of a more sane approach to security.

Comic: XKCD