Slashdot Mirror
Cutting Security To Cut Costs?
just currious asks: "I work for a large company (10,000+ pc's) who recently out sourced the help desk. After looking at about a year's worth of data we find the 30% to 50% of the calls to the helpdesk are password related (password resets, password changes, etc.) this is alot of calls (at 20+ dollars a pop). Now they want to reduce cost by cutting security, since if you don't have a password, you can't forget it. So here's what upper management wants to do: remove the security from all of our Windows 2000 machines. Has anybody else seen security cut just to save money?"
We need to first know where you work. Actually, just the IPs will be fine.
I've been through exactly the same. Problems with passwords vanished within weeks as everything was swapped over. Then piece by piece, random pain in the fucking ARSE problems with other users fucking with fileserver files grew into a major problem. Users saved files anywhere they could with no restrictions. Other users who 'claimed' parts of the server space as their own threw out files that appeared there from other users. Management however, are still happy with their decision to cut security like this, despite nobody having a clue where anything is.
Am I bitter about it? To the point of quitting the instant I can. Thank god I'm not running the servers.
Now they want to reduce cost by cutting security, since if you don't have a password, you can't forget it.
You obviously not a BOIH(Bastard Operator In Hell):
"I lost my password."
"You've no password."
"What do you mean by no password? What's that big f%#*ing word on the screen saying 'Password'?"
"Just press Enter."
"small cap or all cap?"
"...."
Where i work the security is pretty tight (comp locks after 5mins of inactivity, many things turned off, and so on). It's sometimes a pain in the ass, but at least they really take security into account...
Tsuyoikoto ha taisetsu da ne, dakedo namida mo hitsuyousa (Strength is an important thing, but tears too are necessary)
Unfortunately this is a fact of IT - there are those who because they dont understand the need for IT security, means that you are reduced to working at their level.
How many times have you heard this one?
(Regarding a server that is connected to the net for FTP / SSH) "But who would want to hack our server?"
I've often found that lusers actually do understand security concepts, however as soon as a computer is concerned they are thrown out of the window. For example:
Me: "Tell me - do you drive a car?"
Luser: "Yes"
Me: "And does anyone have a specific grudge against you? Would they specifically want to steal your car?"
Luser: "No!"
Me:"So do you lock your car after you park it somewhere?
Luser: "Of course I do!"
Me: "So if no one wants to steal your car, why do you lock it?
I've found they can't answer that one.
The real issue is that people just cant use computers. What would solve the problem would be some form of transparent biometric authentication. Think about how we as human beings authenticate people - we do it all the time from speaking to friends on the phone, to making a transaction at the bank. If speaking to someone you know, you dont use a password - you know what your friend looks, sounds and behaves like, and this is used for "authentication". With a bank, you may not know the person you are about to hand over all your cash to, however because the bank is a big building in the location it's in, you know that it can be "trusted" due to it's physical location.
Regarding passwords with Windows 2000 there are alternatives to this. The simple one is let them have no password, but make it so that their account can only log on from their computer. That will seriously limit the abuse that can happen. Alternatively just quietly delete all your CEO's MP3's and mail abusive messages and pr0n using his account - he'll soon wake up.
Yeah, but the hackers don't want you DATA, fool. They want a place to put thier kiddy porn and tcp reflectors for hacking NSA computers and sending death threats to the president...
... especially now that all your machines have been confiscated as evidence. :)
No, you don't have anything on your network worth stealing
"Your superior intellect is no match for our puny weapons!"
Yes, I have.
Moronically, the highschool I was currently attending. I was the "Assistant Admin" (i WAS the admin, don't let the name fool you).
My principal started getting sick and tired of her front desk people having all of their time wasted by students asking their student numbers (also their password).
She came to me saying to take all passwords off, period. The only exception, mine.
It took 400 flunking students getting straight A report cards magically to set her straight.
Of all the Universal Constants, here's one I know: Nice guys finish last
it depends on whether or not there's anything worth keeping secret on the machines;
NO! This is a fallacy. It doesn't matter if you have the last remaining digital copy of the secret FBI UFO cover-up or just your grandmother's recipies, your computer itself is still a resource that a hacker would love to use.
You machine could be hijacked and used for all sorts of nefarious purposes from DDoSing script kiddies to breaking into banks to being an staging point for a credit card fraud scheme or a terrorist network...
"Your superior intellect is no match for our puny weapons!"
Forced password changes => lots of help desk calls.
What is less obvious is that they don't lead to any significant increase in security. Most people, if forced to change their password every month, will use something easy to remember (and easily guessable), like qwerty1, qwerty2, qwerty3, etc. But they still can't remember which version they are currently on, hence the help desk calls.
If you force users to choose strong passwords but not to keep changing them, you'll get both an increase in security and a decrease in help desk calls.
Surely the most sensible way of sorting this out would be to have a trusted member of staff in each building/department/whatever with the authority to reset passwords. Note, I said *reset* passwords - not the ability to read them.
seany