Workers frustrated with password policies

Dilemma: Security Vs Cost Vs User Satisfaction

While providing consulting service to a bank security management, I discovered that all systems, whether they are identified as critical or not, require every users to change their password ONCE a month. Of course, you could imagine what is going on: 1. Frequent password reset 2. Password reset form submission without prior approval but just on phone communication. 3. Staff put the same password for every system. After taking some interviews with those staff, they also feel very annoyed about it. Single Sign-On technology implemented with historical and out-date platforms and new systems are very challenging and costly. I recommend they start to implement some kind of solutions to synchronize passwords of various systems on the same technological platform and server environment, the progress is good. At least, it curtails some of the administrator effort and staff burden. For a joke, if they deem that all systems are critical, why don?t they pick up a 2-factor authentication by gifting their staff a token or adopt biometric approach, the token-based authentication somehow is adopted for payment systems. However, they don?t want to spend budget on improving staff satisfaction. Anyway, the management never understand the password security could lead to million or even huge reputation risk if their customer information are leaked out. For cost effective, I have just suggested them to change the policy instead. Again, they also don?t want to lessen the control. The management readily lacks the concept of compensating controls and password is just a component indeed. That?s reason it is always a dilemma towards management and security professional to engage the balance of security control, cost and user satisfaction.

Posted by: Anthony, Cheuk Tung, LAI, CISSP, CISA 29 Sep 2005