And then they wonder that people resort to easily predictable patterns such as !1Qaz@2Wsx#3Edc and simply shift it one position to the right with every forced change and repeat at the end of the keyboard.
Comment on Appreciation / shock at workplace IT systems
Dirk@lemmy.ml 8 months ago
They are so heavy on security I have a Citrix environment that takes me 3 logins
My daily routine:
- Take laptop out of locked shelf
- Start Laptop and enter boot password
- Enter Bitlocker password
- Enter username (not saved) and password
- Open Citrix website and login with different username and password
- Enter MFA token to access said website
- Start server connection
- Enter different username/password (not saved) to access server
- Enter different MFA token for the server login
- Start the business-specific application with 3rd set of not saved and different login data
They also have plans to make MFA mandatory for laptop login, too.
Passwords need to be at least 15 characters long for laptops and 30 for servers and 10 for the business-specific application. All need to have uppercase, lowercase, numbers, and special characters and need to be changed every 60 days (for the server login) and cannot be the last 30 passwords.
viking@infosec.pub 8 months ago
Dirk@lemmy.ml 8 months ago
Some users have a barcode scanner connected to the system for doing the business stuff. The barcode scanner registers as HID keyboad …
Yes, they did exactly what you think.
kiwifoxtrot@lemmy.world 8 months ago
Smart. I’ve seen it on manufacturing lines for operators logging into SAP. They put the barcode on the back of their badge.
Dirk@lemmy.ml 8 months ago
That make the badges NFC tags but without actual NFC …
At least they had the code not in direct sight on their desk.
kambusha@lemmy.world 8 months ago
Wint3r!2024
viking@infosec.pub 8 months ago
I see we work with the same people.
ninjan@lemmy.mildgrim.com 8 months ago
Tell them to move to yubikey or similar hardware key which is far more secure than any password policy will ever be and vastly more user friendly. Only downside is the intense shame if you manage to lose it.
The key should stick with the user thus not be stored with the computer when not in use. The key isn’t harmless of course but it takes a very deliberate targeting and advance knowledge about what it goes to and how it can be used. It’s also easy to remote revoke. If you’re extra special paranoid you could of course store the key locked at a separate site if you want nuclear codes levels of security.
PlutoniumAcid@lemmy.world 8 months ago
This insane torture is why there are post-it notes under the keyboards.
skilltheamps@feddit.de 8 months ago
And they believe all employees actually remember so many wildly different and long passwords, and change them regularly to wildly different ones? All this leads to is a single password that barely makes it over the minimum requirements, and a suffix for the stage (like 1 for boot, 2 for bitlocker etc), and then another suffix for the month they changed it. All of that then on sticky notes on the screen.
Dirk@lemmy.ml 8 months ago
I’ve seen plenty of solutions. Sticky notes, a simple text file. External tools like barcode scanners. Using all letters and just
1!at the end (not that this is less secure on technical level than a completely random string, but it’s easier to bruteforce - theoretically), etc. Some people use KeePass (with a stupid 5 letter password).
StopSpazzing@lemmy.world 8 months ago
Yubi keys… for all logins, would solve this mess, geez.
BearOfaTime@lemm.ee 8 months ago
Hahah, omg don’t they realize people are writing that shit down?
I’m big on proper security for business, but holy cow that’s nuts.
BigMikeInAustin@lemmy.world 8 months ago
The early US phone numbers were from a set of a few names, and the 5 digits, because they thought people couldn’t remember 7 digits.
And now people have to remember several sets of at least 8 random symbols, and change them every 60 days.
ThePowerOfGeek@lemmy.world 8 months ago
This sounds like my old place, but much worse.
We used to have laptops we had to lock in a cabinet (yeah, one of those cabinets with a really puny lock that’s easy to pick). And we had to log into n old mainframe system that had numerous environment instances which each required a unique password that had to be changed every 90 days.
We (the software devs) basically rebelled on the laptop situation and insisted they find a better solution. Thankfully they changed policy and of allowed the laptops to be locked into our docking stations, which in turn were locked to our desks.
As for the mainframe system credential management, I tried using a standard third party password manager, but a) it wasn’t a good fit for the credentials, and b) the sys admins or security team forcibly uninstalled it because it wasn’t sanctioned software (even though it was a well-respected and actively maintained one). And our security group refused to go out and find one.
So being a dev, I wrote my own desktop password manager for the mainframe credentials. It was decently secure, but nowhere near as secure as a retail password manager. But it fit the quirks of the mainframe credentials requirements. And after my colleagues and manager did a code review of it, it was considered internal software, and thus fit for use.
As I was leaving they were in the process of removing all our local admin rights (without a clear path on how to accommodate for us developers debugging code - fun times ahead!).
But all of those annoyances pale in comparison to the shit you are having to deal with! Holy hell, that sounds like pure misery! I’m sorry.
Dirk@lemmy.ml 8 months ago
Temporary workaround applications/scripts become de-facto standards sounds familiar. They disabled loading script files in Powershell but you can still copy&paste the file’s content …
People have no idea how absurd IT in corporations is.
Rozauhtuno@lemmy.blahaj.zone 8 months ago
Modern day Kafka.
ikidd@lemmy.world 8 months ago
And I guarantee every one of those passwords are written on a piece of paper at the desk under the keyboard.
BCsven@lemmy.ca 8 months ago
I was going.to auggest a hardware key, but I fear they would add it as another layer rather than as a replacement for this nonsense
NeoNachtwaechter@lemmy.world 8 months ago
My advice for this company: fire 2/3 of all IT staff (including managers). Then tell the remaining ones to cut off unneccessary things and do it better in the future.
Dirk@lemmy.ml 8 months ago
Big international corporate, IT security hired by personal connections instead of skill, IT security never worked in daily business.
The fun thing is, that they refer to NIST guidelines. Which is even funnier because NIST says 12 digits are enough, user-generated 8 digits are fine, no complexity rules, and password changes only “when necessary” (i.e. security breaches).
lemmyng@lemmy.ca 8 months ago
Or they work in a regulated industry that requires pseudo-airgapped machines for remote users, e.g. the machine actually interacting with the systems needs to be within the controlled boundary but the company has a presence in multiple locations, so the solution is to have a Citrix server that the users remote into. But because the SSP also has access control requirements at every stage that take a long time to get updated to newest industry standards, the user still needs to have passwords rotated, MFA, and all that kaboodle.
databender@lemmy.world 7 months ago
This is very close to my workplace but we have about 17 domains to work across, with a separate account for each. It’s frustrating sometimes, but in the end I get paid the same either way.
Dirk@lemmy.ml 7 months ago
Ladies and gentlemen, we have a winner!
blackstampede@sh.itjust.works 8 months ago
Fucking hell.