Timeline for If password expiration is applied, should door-lock expiration be applied too?
Current License: CC BY-SA 4.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 24, 2019 at 14:38 | comment | added | nick012000 | "Yes, phishing exists but I've explicitly talked about remote phishing" I dunno. I could sort of picture a scammer emailing people with "Hello, this is company security. We need you to send us a picture of your company keys so that we can verify that you've been issued the correct keys." | |
| Nov 22, 2019 at 13:21 | comment | added | user163495 |
I would disagree that password rotation mitigates any of these problems. Passwords are rotated in a matter of months. So even if an attacker just has a week of access, that's usually more than enough to establish a more permanent way of access. And further, it reduces the complexity of passwords user's choose. Winter2019 and November2019 are really hot password candidates right now.
|
|
| Nov 22, 2019 at 8:31 | comment | added | VLAZ | Moreover, the disruption caused from somebody being locked out is high - they might be out in the cold/rain and wait until whoever is responsible for the keys drives in to unlock the door for them. So, somebody being locked out of a computer - 5-10 minutes lost and they can drink coffee in the kitchen or something - this can be fixed remotely. Somebody being locked out their office - likely to involve a lot more time and it has to be handled in person. | |
| Nov 22, 2019 at 8:31 | comment | added | VLAZ | One more aspect is the ease of replacing credentials and the disruption it causes if it fails. Changing a password can be completely automated and require low effort on all parties (both user and administrators) to do that. The disruption caused from a forgotten password is also low - it may require a call to the helpdesk (or equivalent) but it's not a big deal and can be handled within minutes. For comparison, changing everybody's key to the office requires high effort - the administrator has to meet every user. Logistics might make it hard - somebody is out sick, for example. | |
| S Nov 22, 2019 at 6:07 | history | suggested | Giacomo1968 | CC BY-SA 4.0 |
Copy edits and small formatting tweaks.
|
| Nov 22, 2019 at 1:27 | review | Suggested edits | |||
| S Nov 22, 2019 at 6:07 | |||||
| Nov 22, 2019 at 0:49 | comment | added | R.. GitHub STOP HELPING ICE | Regarding what @vidarlo said, I've never seen or done a PoC, but I'm fairly confident you could automate photo to key in under 10 minutes turnaround time, with portable gear. It would just take some CV to identify the key, match the blank type, and align it to a template, then a mini CNC mill or laser cutter to cut it from a suitable metal or plastic blank. | |
| Nov 21, 2019 at 18:57 | comment | added | Steve Sether | For example, at my last job I had a physical key to the server room, which was a backup to the HID card. Just before I left there was a significant amount of turnover, and literally nobody even knew I had the key. Of course I turned the key in to a colleague before I left. But it would have been just as easy for this to have been forgotten about. | |
| Nov 21, 2019 at 18:42 | comment | added | Steve Sether | I'd argue that there's different risks with physical locks that warrant changing locks on a semi-regular basis. The first being that keys are incredibly easy to copy, and with turnover being what it is, it's likely you'll have keys in the possession of people that haven't been employed by the company for years. That's one of the reasons many companies use HID devices instead of physical locks and keys. | |
| Nov 21, 2019 at 13:01 | comment | added | Steffen Ullrich | @vidarlo: I've updated the answer to include that not only the usefulness of rotation is less with physical keys but also the costs of rotation are higher - which together makes it better to use other forms of risk mitigation. | |
| Nov 21, 2019 at 12:58 | history | edited | Steffen Ullrich | CC BY-SA 4.0 |
added 246 characters in body
|
| Nov 21, 2019 at 12:44 | comment | added | vidarlo | @SteffenUllrich I think the bigger issue is the cost of checking physical locks. It's expensive, and hard. Checking virtual locks is cheap and trivially possible to automate. | |
| Nov 21, 2019 at 10:43 | history | edited | Steffen Ullrich | CC BY-SA 4.0 |
deleted 5 characters in body
|
| Nov 21, 2019 at 10:40 | comment | added | Steffen Ullrich | @Xenos: I've edited my answer slightly to make it not that absolut that the same risks don't apply at all - but they don't apply in the same severity as with passwords. Yes, phishing exists but I've explicitly talked about remote phishing. And yes, weak keys and locks exist where the same key might match multiple locks but this is not really the same as password reuse but more the same as weak passwords. | |
| Nov 21, 2019 at 10:37 | history | edited | Steffen Ullrich | CC BY-SA 4.0 |
added 54 characters in body
|
| Nov 21, 2019 at 10:28 | comment | added | Xenos | I disagree: key reuse exists (tho it's poor locks usually, but one can open other people mailbox with their own mailbox key for instance), phising exists "my key doesn't work, may you handle yours so I can try?", central server compromise exists (steal lock manufacturer sell+engineering DBs), brute force attack exists (see DeviantOllam "Mastering Master Keys"). Cloning key is undetected (see "copied key" link in the question). I only agree for the last paragraph. | |
| Nov 21, 2019 at 10:28 | comment | added | vidarlo | Keys can be copied from a photo. With modern cameras, such photos can be taken at a distance. Someone that might be targeted should certainly employ security procedures to ensure that keys are never accessible, nor viewable to non-authorized persons. | |
| Nov 21, 2019 at 10:00 | history | answered | Steffen Ullrich | CC BY-SA 4.0 |