Stop Passing Around Those Passwords!

The company has sanctioned the use of an online password vault, so why is there a spreadsheet making the rounds that contains scores of passwords to servers that contain sensitive data?

There’s no getting around that security incidents will happen. The best I can hope for is that they don’t completely ruin my day and that they aren’t specific to my organization, so that I can write about them and possibly help my readers through similar situations.

What happened last week was one of those.

It started when a system administrator, newly hired as a contractor in our India development center, asked me after just a couple of days on the job for administrative access to several key development servers in order to manage accounts. He told me that the password he had for those servers didn’t work. That raised a couple of questions in my mind. Why wasn’t he asking his local supervisor to get that straightened out? And why was he going straight for administrative access when all he really needed were plain-vanilla passwords?

I decided to get his manager’s take on the situation. He agreed; this contractor didn’t need an administrative level of access to those servers. And he thought it odd that the guy was saying that his credentials didn’t work.

With that in mind, I looked at some logs from one of the development servers the contractor wanted admin access for. I saw many unsuccessful login attempts from a Linux server on the India subnet. I had root access to that particular server, so I logged in and took a look at the contractor’s home directory. It was disconcerting to find that it was world readable, which is not the standard for such user accounts. That prompted me to dig deeper, and I discovered two files of interest.

The first, named “password_list.xls,” was password-protected and appeared to be encrypted. Well, that was good, right? But the other file, called “password.txt,” was a text file with one entry. You guessed it: It was the password to the encrypted Excel file.

I opened the spreadsheet to find a plethora of server names, IP addresses, server purposes and the administrative user IDs and associated passwords. Not good at all. The file contained account information for resources that were long ago retired, so it hadn’t been compiled by this new hire. In fact, I learned, the file had been prepared by a former employee and passed around. This was a sickening discovery, alleviated only by the fact that it was no longer hidden from me.

But I had to consider all of those resources to be compromised. My reaction was swift. First, I removed the files and reconfigured the contractor’s home directory. I then called a meeting with the general manager for our India office and our head of IT. We went through the list of accounts and rank-stacked them according to risk. For example, anything in the DMZ that was Internet-facing and any resources containing sensitive data got a priority of 1, meaning that the password had to be changed within 24 hours. The lowest priority that we assigned called for the account passwords to be changed within 72 hours. The extra time was needed in some cases to ensure that we didn’t impact any business processes.

I also ordered a discovery scan to find all locations that contained those password files. Because we don’t have a robust data loss prevention infrastructure, I had to resort to conducting broad file-storage searches, both on the internal network and in the cloud, for files containing the word “password.” (We use Google Docs for collaboration, and there are third-party tools that allow for expanded reporting and searching against all files. I found one, installed an eval copy and was able to conduct my searches.)

I also put a data filter rule in our firewall to trigger an event if someone tried to transmit a file called “password.” Then I sent a companywide message warning against the use of spreadsheets to maintain passwords. We have a corporate-sanctioned password vault that allows for the secure storage, management and sharing of passwords, so there is (generally) no reason to keep passwords on spreadsheets. I say “generally” because certain passwords, such as encryption key passphrases and passwords for critical resources, are printed out and kept in a safe, because we’re just too paranoid to store them in an online, digital password vault.

There was just one more thing to do to put this incident behind us: Our general manager in India terminated the contractor.

This week's journal is written by a real security manager, "Mathias Thurman," whose name and employer have been disguised for obvious reasons. Contact him at mathias_thurman@yahoo.com.

Click here for more security articles.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securitypasswords

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

By Mathias Thurman

Computerworld (US)
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?