@antdaviscyber: A UK school data manager refused to change her password because everyone already knew it. It was letmein, taped to her desk, and she had used it since 1998. What is the shared login or workaround at your workplace that nobody says out loud? loud? #cybersecurity #passwords #infosec #cyberawareness #techtok

Zargotaa :

Isn't letmein 7 letters? Not six?

Nateu :

Aka talk with people to understand, not to convince them of your stuff.

Valucci :

letmein?? aint that the default cisco switch password?? 😭😭

. :

My job has a shared login. Reason? If we had individual accounts, we would have to do a full onboarding and offboarding for every contractor that we hire. Turnover expects contractors to last 2-5 months on average. IT requires a full 10 days for every onboarding. Also, we have people ready to float in and cover a shift if someone calls out. Those floaters might only work a couple times a year. Our IT policy is to automatically offboard any account that isn't used for 3 months. So someone coming in to emergency cover a shift that no one else can cover once every 5 of so months likely won't have a working account most of the time when they come in and since no one else can cover the shift, they would have no way to log in without a shared account.

mibloem :

the gotcha with the nist rule is you also need to be sure people have good passwords. without a mechanism to confirm this, dropping password cycling is an own goal.

killrklownfromouterspace :

Why not just grant report privileges to others instead of rolling back the password policy

Chilled.Design :

They’re called service accounts, heavily locked down, audited. Passwords are only revealed on a need to know basis. Usually only used for old/legacy systems. Nowadays SAML SSO rules the roost.

_123qwerty098_ :

Change the complexity rules and tell everyone it’s because of that particular person…

BricksBizBuilds :

She was a Data Manager and had a single, shared password?? Crazy.

sleepyuser :

Let me bring up a different but related topic - “as a developer if I leave the malware scanner, running my builds take 3-5 times longer” - 9 out of 10 it departments don’t understand why that causes otherwise smart engineers to become your biggest adversarial in security. Developers will spend two weeks to improve a build by 5% so being unresponsive to their complaining is effectively opening the backdoors yourself.

key :

"nobody else can get the reports" shared permissions fixes it.

DopplegangerNZ 🇳🇿 :

Remind me, LDAP / AD and group based policy authorisation have been around for how many decades now?

Mr Benn :

On the plus side I got to know my managers 3 kids names and birthdays over 3 years from passwords [Tears of joy][Tears of joy][Tears of joy]

NiC 🇧🇧 :

This isn’t an uncommon occurrence with older small organizations where the staff exists like a family or community. Where internal group confidence and trust is high and leadership focuses more on group cohesion to get work done, IT changes can be hard to enforce because underlying processes tend to be informal or lax. Coming in as an outsider means having to integrate into those communities to understand the process before successful changes can be attempted.

d.cowan2013 :

I’m surprised that they haven’t been hit with ransom…. There it is!

Henry Taylor :

I had to use my coworkers access for 3 months while she was on maternity leave. I didn’t want to forget my passwords so I changed mine to be hers. Years later I still use her daughter’s names for my password.

M :

IT in schools is horrible.

Ed :

I was going to say, that sounds like something that could be solved fairly easily with a bit of automation. Ideally, and that is the operative word, nothing that is business critical should run from a specific user account

Deano from Lancs :

Pa55w0rd 🫡

mickey :

A friend was a BSi auditor at one stage. He would walk in to server rooms and check under keyboards and white boards for post-its or passwords. Any password found was an immediate security failure

RexCT7567 :

feel like usb keys would have been better then passwords at that place

Darrall Alexander 〓〓 :

Chazmers :

Wait till they've heard about AD Groups. It'll blow their mind.

Cyber Taz :

Since 1998 🤣😭😭😭

Doug Griffin :

Exactly. Find the reason, and fix the problem.