Posted by David Hunt
The field of security is constantly growing, shifting and adapting to meet an ever changing threat landscape. To provide a degree of order in this chaotic landscape, we look to compliance standards such as NIST 800-53, PCI, HIPPA, ISO’s …. These standards provide frameworks which allow us to measure or determine the maturity of an organization’s security program. However, these frameworks need to be tempered by the current security environment or we risk sacrificing our security for compliance.
This idea was illustrated nicely at this year’s BSides Las Vegas security conference. Lorrie Cranor the Chief Technologist for the Federal Trade Commission provided the keynote speech about why we need to start training our clients and end users to reevaluate their thinking on mandatory password changes. In brief, Lorrie questioned the practice of frequent mandatory password changes, meant to prevent brute forcing (trying all possible combinations) or to lock out those who may have a shared or stolen password.
Here is what she found: Frequent password change requirements can actually make us less secure based on two separate studies. Lorrie’s message was to empower users to create good passwords and agree on what good is, while addressing common misconceptions. Questionmark OnDemand’s new portal, empowers customers to determine what good passwords are and to create customized roles based on their requirements. When configuring passwords requirements for your OnDemand users, consider Lorries advice for passwords.
- Avoid common words, names
- Avoid patterns
- Digits and symbols add strength
- Understand different types of attacks
- Make them Better (Not Perfect)
- Change them only when Required
- Start with your Core accounts
- Use Tools where appropriate
In this case, Lorrie did not blindly follow the path of compliance, leading to ever shorter password refresh limits. She got it right by looking at the issue from a security perspective. What are the threats to the use of passwords and are our mitigations of these threats reducing our risk? The answer, when it comes to mandatory password changes, is NO! We are actually increasing our risk in some cases. So when setting password policies in Questionmark OnDemand, it is always a good practice to regularly review your settings to ensure you are getting it right.
As with any good keynote speech, this one was a catalyst for many subsequent conversations both at and after the conference.
The dangers of security programs that blindly check compliance requirements off a list, news-driven security programs, and the proverbial not being able to see the security forest for the trees. The takeaway from these conversations was that we have an obligation to “disobey.” Not that we should break the rules but rather question them — lest we face a fate such as that which befell those in “The Charge of the Light Brigade,” a poem describing the tragedy resulting from the miscommunication of orders at the Battle of Balaclava. in our case, we may not face a physical death by blindly following orders, but a virtual death is plausible.
Just as Lorrie asked “Why?” we should be asking it as well. As anyone who has spent time with a 3-year-old child knows, this one simple question is the key to building knowledge. We all should ask “Why?” and grow our technical and security knowledge to ensure we are not just compliant, but secure!