10

Whenever it is time to change passwords, each user in our office has to provide our new password to the IT department and they change it & store it. Can you provide something that details why this is a bad firm policy?

Windows Server 2012; Users have Windows 7 Professional on desktops

Improve this question
4
  • 5
    This is intriguing and my first response would be that your IT dept are inept. Can you provide a little more info - is this your domain? Is it Windows / Linux / thin client / how many users do you have passwords to how many systems etc?
    – iainpb
    Commented Jan 3, 2017 at 16:28
  • @iain I have worked in orgs where this was the case for a legacy system. Sometimes technology is a barrier.
    – schroeder ♦
    Commented Jan 3, 2017 at 16:30
  • 2
    Not just inept but also stupid! Might as well just have a single id for the whole organisation :-)
    – Julian Knight
    Commented Jan 3, 2017 at 17:11
  • And the passwords you are talking about are the domain passwords? Is there a stated reason for the 'policy'?
    – schroeder ♦
    Commented Jan 3, 2017 at 18:42

4 Answers 4

Reset to default
21

This means that the IT department is liable for the knowledge of those passwords. Anything that happens on the network can no longer be attributed to the user, but now it could be the user or anyone in the IT department or anyone with access to the password store.

IT should not want that responsibility.

Improve this answer
3
  • 4
    Yes, this is referred to as "integrity" and is one of the 3 fundamentals of information security ;-) The "good" news is that that no employee can be held accountable for actions on their account. Just claim "it wasn't me" and let management and IT fight it out.
    – Julian Knight
    Commented Jan 3, 2017 at 17:10
  • Interestingly though, network admins can backdoor/keylog passwords anyways, so they can never be ruled out without forensics.
    – billc.cn
    Commented Jan 10, 2017 at 11:51
  • 2
    @billc.cn except for someone to claim that something like that happened, the burden of proof would be on them. In the above case, no such burden exists: it's policy.
    – schroeder ♦
    Commented Jan 10, 2017 at 17:48
11

Is this policy bad?

I have no idea. "Bad" is not a technical term and is ambiguously defined. I sure as hell would never do that though.

Is this policy common practice?

No.

Are there any potential requirements that would be inconsistent with this policy?

  • If your organization maintains cybersecurity compliance (e.g. PCI, FDIC, ISO, or TCSEC) this practice is not allowed
  • If your operations require nonrepudiation
  • If your operations require auditability
  • This policy is at odds with the principle of least privilege.
  • This policy is at odds with the principle of compartmentalization.
  • It might be illegal in certain contexts.
  • You may have trouble firing an employee whose password is used for prohibited purposes (e.g. an employee whose password was used for porn).

Are there any potential requirements that would be consistent with this practice?

  • If your organization requires a common password across different systems among which automated password synchronization is not possible
  • If your policy and procedures require managers to know the passwords of their reports, e.g. for supervision (although usually there are better alternatives)
  • If your employees have a history of choosing poor passwords, and there is no way to set up satisfactory password complexity rules
  • If your employees have a history of forgetting their passwords, and there is no way to set up self service password recovery
  • If your organization does not wish to grant the ability to change passwords to the employees at large
  • If the passwords grant access to third party resources to which the business must have access in general (e.g. an official Twitter account)
Improve this answer
6
  • 1
    I disagree here; knowing users' passwords is very firmly considered "bad" in the context of cybersecurity best practices. There should be no reason to require this unless other aspects of the system are very poorly designed.
    – tlng05
    Commented Jan 4, 2017 at 1:10
  • 2
    And you will win that argument, because there is no counterargument to "That is bad!" other than "No it isn't!" which never gets anywhere. P.S. see link.
    – John Wu
    Commented Jan 4, 2017 at 1:17
  • I don't see how this is a subjective question. There are a large number of objective, concrete reasons why this is poor practice that other answers are bringing up, and very few good reasons for doing it that don't reflect poor system design elsewhere.
    – tlng05
    Commented Jan 4, 2017 at 2:27
  • 1
    Could be "poor" system design (whatever that means). Or it could be economical system design, e.g. for a very small company with a very limited budget, in which case the design may be appropriate. Whenever you use words like "bad" you are making unstated assumptions and it is proper for an engineer to demand that requirements, and the value system against which they are judged, be explicit. Perhaps it is just a pet peeve of mine.
    – John Wu
    Commented Jan 4, 2017 at 4:23
  • On the InfoSec stack, I think it is appropriate to assume that the value system being used is following best practices in InfoSec, which this system clearly does not. If there are other constraints that could require deviation from best practice, the OP needs to bring them up for it to be considered.
    – tlng05
    Commented Jan 4, 2017 at 4:35
4

Bad idea? This is appalling.

  • Most users reuse passwords across environments - office and work. Hint, hint - Bank account.

  • This leads me to believe that your IT department is manually doing this work - slow and open to abuse by an unhappy worker.

  • Plaintext transmission of passwords

  • Plaintext storage of passwords

Besides, this, I'm sure it's possible to come up with a hundred other reasons - I've just listed out the most obvious as a starting point for you.

Improve this answer
0

One of the key principles of cyber security is Confidentiality.

I would imagine that the passwords would be hashed and stored in a database but the admin must know the plaintext value before it is hashed. Your password should only be known to you, if the admin decides tomorrow that he is sick of his life and wants to inflict damage on someone and knows your password. Let's say they made unwanted advances towards you and you brushed them off, they have the power to inflict damage in your name and blame it on you.

If I was a hacker, this would increase the possibility of gaining entry, if there are two attack vectors rather than just one.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .