2

I discovered recently that organisation X is storing web app usernames and clear text passwords in excel sheets on their internal network filestore.

These are not used for authentication.

I have tried to argue that the sheets should be encrypted/have some password mechanism.

The ultimate response, seems to be: if someone has gained access to read the excel sheet then they already have such wide access, the passwords are the least of the problem.

I have also suggested building a second network and moving the most crucial data to ithe, with very limited access. There was concern regarding the admin overhead of this.

I don't know where or how to proceed in the discussion. Please help?

Improve this question
1
  • Are these passwords for customers or members of the organization? Also, is this an app where other sensitive information is stored on the internal network? If you're storing customer passwords and little other sensitive information on the network getting passwords is one of the worst things for the customers. An intruder could likely use many of those passwords on other applications successfully since people reuse passwords. I'm not sure how easy it'd be to intercept those passwords through other methods (besides the spreadsheet) if you already had network file access.
    – Cody P
    Nov 4, 2016 at 23:15

1 Answer 1

Reset to default
6

Clear text passwords in and of themselves are not a problem. The problem is with the risks associated with that data. What is the impact to the users, and what is the impact to the company if this data is leaked, disclosed, lost, or corrupted? What if it was publicised that this data was in the clear, as you describe?

If there are no risks, then it does not make sense to implement costly controls around it.

If there are risks, then the controls need to be scaled with those risks.

I know that it is easy to say, "OMG! Clear text passwords from a web app in 2016?! What kind of a company is this? There are numerous libraries that the devs could have called to take care of this from the beginning!" I know I did when I read your post.

But at this point, changes to the environment need to make sense in terms of the risks involved. Your job is not to come up with the most compelling technical or security argument (if one of those arguments would have worked, then the problem would not exist). Instead, your job is to quantify the risks to the company and propose a control appropriate to those risks to mitigate them. That's how you proceed.

If the risks are high and costly and they are still not interested, then ask them if their fire insurance is paid up. Small investments can stave off massive losses, just like insurance.

If you still cannot get them to deal with this, then you are left with the unfortunate, yet valid, situation of leaving this business decision in the hands of the business. They bear the risks. You gave them the needed info to manage those risks appropriately. There is not much else you can do.

But before you get to the fatalistic stage, get a good discussion going around the risks and how you can help them limit the company's exposure.

Improve this answer
6
  • It's not just the business that bears risks. Imagine having "Security engineer for LinkedIn" on your resume.
    – Robert Fraser
    Nov 5, 2016 at 3:44
  • @RobertFraser Sure, it might become a question that comes up in interviews, but even a Security Engineer needs to know how to talk to business, how to work with business, and how to apply one's expertise to guide the business. What a wonderful example to give in an interview to show your ability to mesh your technical expertise with your ability to apply that expertise in a business setting.
    – schroeder ♦
    Nov 5, 2016 at 7:58
  • In case management is interested, it might be worth pointing out that you are mainly causing risk to your users, not just risk to the company. Whether that is seen as relevant will depend on your organization's level of sociopathy.
    – Dominik
    Aug 2, 2018 at 11:24
  • @dominik I already covered user risks in my answer
    – schroeder ♦
    Aug 2, 2018 at 12:14
  • @schroeder you mentioned it but I think it needs to be stressed. "Quantify the risks to the company" and "They [the company] bear the risk" falls short of what is going on, as does the fire insurance comparison. We are talking about harm mostly to other people.
    – Dominik
    Aug 2, 2018 at 13:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .