When risk is present it calls for treatment, and security is a never-ending process, right? Yes, but as a security professional, it's easy to become focused on the hard problems of security and lose sight of the impact of the controls themselves.
Balance is key in the push-pull between security and business objectives, and sometimes those of us on the security side go too far.
A friend of mine recently hired on as information security manager at a major government agency. When I met him for lunch a month after he started, he was still sporting a stick-on visitor badge that indicated he needed an escort within the secure areas of his building. Likewise, I saw an international client's new help desk coordinator repeatedly locked out of her shared office when co-workers departed for a smoke break.
Both of these people have significant levels of access to sensitive data, but end up locked out of their own workspaces, physically as well as virtually, because the identification and access management methods are overwrought or out of sync with the employment process.
The lack of coordination between issuance of physical and logical access indicates problems in the hiring process and disjointed management decisions regarding access. I haven't seen many instances where new employees in any organization are greeted on their first day with a coordinated issuance of access credentials, computer, phone, and keys. It's a challenge for most to simply get an ID badge on the first day.
A handy solution is to use the list of things that have to be done when someone is terminated. Human Resources usually has a termination checklist of tasks that includes obtaining the employee's ID and keys; disabling system, network and application accounts; and ensuring that computers, mobile phone and other company property are returned. If one takes this type of list and turns it around as a guideline for the access- and asset-granting process when a new employee is hired, it's easy to see where the delays and other problems might lie. The same people that authorize revocation of access upon termination ought to be the ones who grant it to begin with. If more than two or three people's authorization is required to make it all the way through the list, some streamlining is in order.
Password problems
The classic problem with passwords is that users simply can't remember them when they follow the rules for minimum complexity, or keep track of them when they have to be rotated frequently.
To compensate, they resort to repeating patterns that are easy to remember (and predict) or write down passwords on notepads, whiteboards or even right on the case of the computer. Instead of the uber-secure one-time pad method for passwords, where a series of single-use passwords is given to a user (usually on a tear-off pad of paper) and replenished when used up, the sticky-note-by-the-monitor pad is used, subverting password standards.
Stern messages and harsh penalties for such practices are often ineffective remedies because most people's memory simply isn't enhanced by punishment. Those who have difficulty remembering names, for example, have far more success when they resort to mnemonics or imagery-based association methods, as opposed to being sanctioned or threatened.
In an IT context, notes and patterns introduce an unwanted element of predictability -- or so we're used to thinking. In practice, however, the trade-off between accepting some degree of patterning and recording of passwords is often well worth the return in increased password strength and rotation.
That being the case, it's worthwhile to provide instructions on how to create a password that's easy to remember but hard to guess. This is a great alternative to mandating password requirements that go too far and which may lead to widespread contempt for security guidelines.
Join the CIO New Zealand group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.