Slashdot Mirror
Study Finds Password Misuse In Hospitals Is 'Endemic' (securityledger.com)
chicksdaddy writes from a report via The Security Ledger: Hospitals are pretty hygienic places -- except when it comes to passwords, it seems. That's the conclusion of a recent study by researchers at Dartmouth College, the University of Pennsylvania and USC, which found that efforts to circumvent password protections are "endemic" in healthcare environments and mostly go unnoticed by hospital IT staff. The report describes what can only be described as wholesale abandonment of security best practices at hospitals and other clinical environments -- with the bad behavior being driven by necessity rather than malice. "In hospital after hospital and clinic after clinic, we find users write down passwords everywhere," the report reads. "Sticky notes form sticky stalagmites on medical devices and in medication preparation rooms. We've observed entire hospital units share a password to a medical device, where the password is taped onto the device. We found emergency room supply rooms with locked doors where the lock code was written on the door -- no one wanted to prevent a clinician from obtaining emergency supplies because they didn't remember the code." Competing priorities of clinical staff and information technology staff bear much of the blame. Specifically: IT staff and management are often focused on regulatory compliance and securing healthcare environments. They are excoriated for lapses in security that result in the theft or loss of data. Clinical staff, on the other hand, are focused on patient care and ensuring good health outcomes, said Ross Koppel, one of the authors of the report, who told The Security Ledger. Those two competing goals often clash. "IT want to be good guys. They're not out to make life miserable for the clinical staff, but they often do," he said.
If you forget a password, someone may die right in front of you. You can choose to write that password down and reduce security, or you can take a chance that you'll forget what this month's 12 character combination of at least two upper case, two lower case, 2 numbers, and 2 non-alphanumeric characters is in a pressure situation and the result will be death or injury to a human in your care and, likely, a lawsuit and dismissal.
Until this is fixed, people are going to write down passwords.
Is it just my observation, or are there way too many stupid people in the world?
Let me remind everyone here that there are always two failure modes of a simple component, type 1 and type 2. A switch can fail open-circuit or short-circuit; a lock can fail locked or open, and a password failure can be either "will let people in who shouldn't be allowed to get in" or "won't let people in who need to get in".
You can alway take one failure rate to zero by making the other failure rate 100%. Reducing the rate of type 1 errors tends to increase the rate of type 2 errors, and vice versa.
Basically, the hospital workers are voting "there are too many errors of the type "can't get in when we need to", and we need a work-around to prevent this."
http://www.geoffreylandis.com
I work in an analytical simulation lab, and as a sysadmin these guys are notorious for sharing their passwords either out of an inability to understand unix file permissions or out of callous disregard. I was told when I joined that "this is just how it is" and that kind of management level complacency is what i think drove it all.
my solution was 3 fold. First, I expired everyones password. Next, departments are restricted to their specific laptops and workstations. Analytics should not be logging into design workstations, or vice versa. And finally, yubikey for anyone who needs access to finite elements or VPN, or simulator hardware that runs in a test chamber. The whole thing required serious management buy-in, which was easily the hardest part. It also required me to train users on posix permissions and how to properly collaborate in a unix-like environment, which for most newer college grads was completely foreign. greybeards in the labs were a huge help here.
Good people go to bed earlier.
Security that gets into the way of the worker to the point where it hinders him in his actual work will be circumvented without remorse. Actually, it will be done with the justification of increasing productivity. An example:
Take a security door that MUST be closed all the time for security reasons because something valuable is stored behind that door. Now take a worker that has to haul heavy items through that door. The prescribed flow of operation would be that he unlocks the door, goes through it, locks the door behind him, picks up whatever heavy item he has to haul, puts it down at the door, unlocks the door, opens the door, carries the heavy item through, puts it back down, closes the door, locks the door and then carries the heavy item to its destination.
How many times do you think he'll do this before that door is wedged open?
To him, that door is a nuisance and, worse, it is something that lowers his productivity and, in his opinion because he does not know the other implications, hurts his company. It isn't something he does for personal gain where he'd hurt his company, like checking his Facebook page on company time or watching YouTube videos, something he would at least feel guilty for, it is something he does FOR the company because it means he can work faster.
That is by some margin the worst kind of security infraction because it is done without remorse and with a good justification.
How much more likely is something in a health related area where the justification can well be saving someone's life?
This is why you have to plan your security in such a way that it does not impede the workflow of your workers more than absolutely necessary. Yes, that means you have to actually do your fucking job as a CISO and not just spout some insane and harebrained password requirements that force everyone to write it down 'cause they cannot remember them. You have to find out how to automatize away security from your workers. Perfect security isn't one where your workers stumble upon it every single time they want to do it, perfect security is achieved if the worker doesn't even interact with it anymore and hence CANNOT fuck it up, neither deliberately nor accidentally.
The aforementioned door could be made secure without causing your worker additional stress simply by giving him a RFID token and the door opening if it is being scanned. If you want to make theft of the token unlikely, activate it when the worker signs in in the morning (using the RFID token and a pin key, so someone stealing the RFID token would not know the pin) and deactivate it when he leaves. This is trivially possible and if whatever you have to secure is so important, the cost for implementing this are negligible as well.
But you have to do it. Instead of just offloading the burden of security onto your workers.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
The fact that we IT professionals have not come up with a universal replacement for passwords is the IT industry's biggest failure in my lifetime.
Security professionals cannot simply demand that business stops when security policies are not met. IT security and policies should support the mission of the organization - not the other way around.
Implant all the staff with chips. The kind they use for pets.
Then they can log on by head-butting the computer.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."