Slashdot Mirror
40 Percent of Organizations Store Admin Passwords In Word Documents, Says Survey (esecurityplanet.com)
While the IT industry is making progress in securing information and communications systems from cyberattacks, a new survey from cybersecurity company CyberArk says several critical areas, such as privileged account security, third-party vendor access and cloud platforms are undermining them. An anonymous Slashdot reader shares with us the details of the report via eSecurity Planet: According to the results of a recent survey of 750 IT security decision makers worldwide, 40 percent of organizations store privileged and administrative passwords in a Word document or spreadsheet, while 28 percent use a shared server or USB stick. Still, the survey, sponsored by CyberArk and conducted by Vanson Bourne, also found that 55 percent of respondents said they have evolved processes for managing privileged accounts. Fully 79 percent of respondents said they have learned lessons from major cyberattacks and have taken appropriate action to improve security. Sixty-seven percent now believe their CEO and board of directors provide sound cybersecurity leadership, up from 57 percent in 2015. Three out of four IT decision makers now believe they can prevent attackers from breaking into their internal network, a huge increase from 44 percent in 2015 -- and 82 percent believe the security industry in general is making progress against cyberattackers. Still, 36 percent believe a cyberattacker is currently on their network or has been within the past 12 months, and 46 percent believe their organization was a victim of a ransomware attack over the past two years. And while 95 percent of organizations now have a cybersecurity emergency response plan, only 45 percent communicate and regularly test that plan with all IT staff. Sixty-eight percent of organizations cite losing customer data as one of their biggest concerns following a cyberattack, and 57 percent of organizations that store information in the cloud are not completely confident in their cloud provider's ability to protect their data.
And damn proud off it.
but we do keep them on USB keys in our vault so i like to think that balances it out
I have a closed system that has 2 Windows servers, sql server, 14 red hat servers and a win 7 laptop. Each has a user and admin account. Each has strict DoD based password criteria including expiring every 60 days, no repeats, etc. that's 32 passwords to manage with 6 developers working on the system.
Well, at least they're not stored in plain text.
*puts on a pair of sunglasses*
...Word and excel will 'auto-correct' anything that starts with two capital letters and de-capitalize the second character.
/It's so secure even YOU won't know your passwords!
writes it on the wall.
I store them in a txt file in Google drive.
gpg2 --symmetric passwords.txt.safe
gpg2 --decrypt passwords.txt
And memorise a crazy hard passoword which also assists me in solving a parity error on the rubics cube revenge with a small variation.
Postit note FTW!
but the word doc is securely protected with a password.
Slashdot, fix the reply notifications... You won't get away with it...
...considering 75% of organizations use sticky notes on a monitor.
LibreOffice! Or are Post-It_Notes better? LOL!!!
Not encrypted is the problem
We had the most incompetent sys admin I had seen when our company was in infancy. Slacked off most of the time. So he convinced the receptionist to step and fix urgent things like printer queue issues and restarting print server etc. How? Below the large monthly planner she had on the front desk, was a whole bunch of post-it notes. Each note started with su password and then some commands. About 10 or 15 of them. Worst. Sysadmin. Ever.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Excel is much better for storing passwords.
Hah! We are so much better. We don't use Word to store passwords.
We use LibreOffice!
The real "Libtards" are the Libertarians!
Keep passwords safe. Buy a typewriter, get a sheet of paper from your networked printer, insert in typewriter, type out passwords, buy a 1 ton safe, stick piece of paper in safe, lock safe. Whilst they and I mean they, plural (a 1 ton safe is a 1 ton safe for a reason), can drive to your offices and steal that safe, it is kind of hard to not notice it missing and to be able to re secure you system again.
The problem with securing computers with computers is you can no longer see them breaking in successfully, sure you can see the lame failures, but not the skilled success until it is way too late. https://www.theguardian.com/wo..., https://www.theguardian.com/wo.... Computers are shit at security because you can not see what is going on and there are just so, so many ways to hack it and all from safe remote locations, hacking a safe, up close and personal and extreme risk, it is just the way it is.
They used to produce computers with hard wired switchs to prevent firmware being overwritten, no direct access phsyically impossible to hack remotely, hard wired switches to shut down wireless network cards, switch off no power to that card what so ever. So your core data server should have a hard wired switch to prevent writing to it, except when authorised and with direct personal access (to hack you have to write to read).
Chaos - everything, everywhere, everywhen
Remember that 40% counts IT admins that ask Reddit for advice. Every deadbeat coworker that has survived by kissing ass or nepotism.
And that's nothing unique to IT. It's like that in everywhere I've worked.
I sore all my passwords in the Oxford English Dictionary and they are already written in the print with me doing a god damn thing.
Ha ha
Just like the ancient old days, my admin passwords are 'password'. Why change them we get new systems, makes it harder for the vendor to correct issues.
Every office stores passwords on Post-It(tm) notes stuck to the bottom of their keyboards. Completely hacker-proof!
Have you read my blog lately?
It's not like we haven't had 1Password, LastPass, and Password Safe for at least the past decade.
What year is this? Seriously, man, what decade is this?
Kriston
so.... a plain txt file is bad i'm guessing
Ideally, there should be no "admin password". Individual people should have their own passwords, each with appropriate privileges, via groups if your organization has more than about a dozen people.
So then we have the question of the most secure way to store your individual passwords.
If you can still find an old-school "personal organizer" with no wifi, that provides security from network attacks. Then you need physical security to ensure the device doesn't get stolen - lock the door, lock at least one desk drawer, etc.
What I do personally is I use a very simple, non-networked, password vault script. The script uses AES or Twofish to encrypt a plain text file (notepad). A simple batch file can run GPG to do the encryption and decryption. The file is never opened in a feature-rich, macro-capable word processor like Microsoft Word, it's decrypted into simple text editor. Just to be sure I don't overwrite my access.gpg file with garbage by entering the master password incorrectly, my script checks the password entered against a SALTED SHA-2 hash before it does anything else.
You have to keep passwords written somewhere because stupid sysadmins have such insane password rules and retention times that no-one could possibly remember them. In theory word documents are at lest better than post-its because they COULD have some access control.
The tighter you squeeze, sysadmins, the more systems will slip through your fingers.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
we use excel.
I thought that was the problem it was supposed to solve, namely there were no 'root' accounts but a list of trusted users.
My Boss insisted we do this and it came back to bite his arse really hard. My boss a few years back was a grade A twat. He had IT experience on Sun Microsystems equipment but when it came to the last 20 years with PC's he was way out of his depth, but being the IT director he could cover his arse easily with the CEO by taking the credit who what we did. I ran the IT department of 10 people but he always wanted to have the last say in anything and over time he slowly fucked things up real bad. I kept all his hand written decisions plus the odd email instruction to cover my arse, well I had to as he was a Grade A twat (did I mention this already), anyway one of the daft things he insisted was to write all the system passwords in clear text in a Word document that was not password protected. Over time I finally left with most of the other IT staff (in approx 3 weeks) leaving him to take the running of the department full time and of course he quickly found out how out of his depth he was, the CEO was piling loads of pressure onto him and he could not do the simplest of things making look a Grade A twat to the CEO and other directors and more important to our customers. Then he decided to do a security audit and wiped the 2 of the main NT servers and thus shutting down the the company IT systems. And of course the password list document was on one of these servers. Then it came out he had stopped doing the backups for a few months so no backups!!!!!!! and the one remaining server was now locked out as he could not remember the admin password. The next day he was sacked and many people cheered
Why is biometric authentication not completely standard by now? It's standard on personal phones, why is it not standard on all company computers? I mean, seriously, it's getting embarrassing now.
Storing them in notepad is out of the question? :)
This type of article gets posted on slashdot every few months and the answer is the same: password security is lame.
With the password security requirements evolving due to things like sophisticated distributed computing brute force cracking, it has arrived at the point where people literally cannot remember passwords anymore. Therefore, because they are mandated to use passwords that are in compliance they do the only reasonable thing they can to comply to get their jobs done, they write the passwords down somewhere.
Try the 5 Why's technique on this one
Why are security breaches happening? Because people write their passwords down.
Why do people write their passwords down? So they can do their job.
The rest is an exercise for the IT and compliance administrators. Remember, use common sense. It's not hard
We'll make great pets
There's a plethora of off-the-shelf password managers out there that support encryption but you can also create an easy, DIY distributed/encrypted solution with GPG, git and vim.
There's really no excuse to be storing sensitive credentials in office documents or spreadsheets.
Have a squat over at the hobo house.
Simple really...
I have a closed system that has 2 Windows servers, sql server, 14 red hat servers and a win 7 laptop. Each has a user and admin account. Each has strict DoD based password criteria including expiring every 60 days, no repeats, etc. that's 32 passwords to manage with 6 developers working on the system.
Take your pick:
* https://www.reddit.com/r/sysadmin/comments/24jb4e/how_do_you_guys_keep_track_of_passwords/
* https://www.reddit.com/r/sysadmin/comments/3f5ot6/password_manager/
* https://www.reddit.com/r/sysadmin/comments/41obgx/best_way_to_store_passwords_more/
* https://www.reddit.com/r/sysadmin/comments/2j9wo4/best_way_to_store_passwords_for_production_systems/
KeePass and SecretServer by Thycotic seem to be regularly recommended.
For the Unix folks reading:
* https://www.passwordstore.org
Another 40% store them on Google docs.
Word documents? What kind of loser sysadmin uses Word? Everyone knows that machine databases get maintained in an Excel file on a network share.
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.
Some of my passwords I easily remember. Some of the others are written down - some on a page in a diary, others in Sticky Notes in one of my Windows 10 logins.
Part of the reason for this is the disparate password rules that some organizations FORCE on us. Password must be 8 characters, password must contain mix of lower and upper case, password must include special characters, password must start w/ a letter or number but not a special character, and so on. As a result, some of the passwords I would have used in some cases using my own mental password creating algorithm had to be tossed out, and then I had to record those exception passwords somewhere, and lost them when a computer dump happened.
My suggestion - just toss out all the rules, and let people make whatever they want. If I want my password to be pwd, let me. If I want it to be )%^, don't insist that I include at least 1 lowercase and 1 number or any of that. Or just have 2 factor authentication, and get rid of all the passwords.
Thankfully, our organization is not one of these. We store our passwords in a Notepad document.
You're right that you shouldn't log in using the admin password to read email. You also shouldn't log in to the admin account, using the admin password, in order to install aoftware.
People leave your organization. If you have groups of people logging to the admin account, using the admin password, the guy who got fired yesterday probably still has the admin password. It's stored on Joe Schmoe's mobile device too, which just got hacked.
Instead, Joe should log in as Joe. The logs will show that Joe logged in, not "somebody logged in as admin", and when Joe gets fired you can simply disable Joe's account. Initially, he has just the standard permissions to do his daily work. For privileged tasks, he should use sudo or similar, not log out and then log in again as "admin", using a password shared amongst every body in the department.
Repeat after me "sharing passwords is bad." Sharing ADMINISTRATIVE passwords is extra bad. Switching ROLES from unprivileged to privileged should not mean changing IDENTITIES from "Bob" to "somebody who has the admin password, might be anyone in the department."
Three out of four IT decision makers now incorrectly believe they can prevent attackers from breaking into their internal network
There, fixed that for them.
"I'm too busy to research this and form an educated opinion, but I do have time to tell everyone my uninformed opinion."
The other 60% use Excel :)