Security Profession blog
Comment and discussion about the security industry of interest to the security professional. Blogs will be submitted by (ISC)2's management team and Advisory Board members.
Thursday 11 September 2008, 8:10 AM
The human factor will always get you
What’s all this got to do with information security I hear you ask? Well an ex-colleague of mine at the Royal Bank of Scotland used to say that “Minority report” should be obligatory viewing for all information security managers. Why? Because later on in the film Cruise breaks in to his old unit and the way he does it is to use his “old” eyes that he has retained after the transplant as a means of access. As you probably realise, this worked successfully because his user id and access had not been removed from the system.
The lesson to be learnt here is that no matter how sophisticated the mechanisms we implement, without the appropriate manual controls they can always be circumnavigated.
John Colley, CISSP
Managing Director EMEA
(ISC)2
PreviousComments on this post
And in reverse - we've just instituted a much more aggressive password retirement policy (ostensibly for compliance: I have my doubts). I've had my password expire on me twice now and been locked out - the first time repeatedly, because of an issue I won't go into here but which means more pain for me every time in future. The systems we use don't really understand that I may be working on any one of a number of devices (most certainly not limited to hardware that the company manages, or PCs at all) from anywhere on the planet.
And as for generating a new password I can remember - well, if there's anyone who doesn't either use a sequence which would be absolutely obvious to anyone except the computer, or write the thing down on a Post-It note, they're probably not really human. Exactly what is gained by me changing 54frogspawn to 55frogspawn to 56frogspawn every 90 days, I'm not sure - but I know my life is made marginally harder by this constant irritation in return for what is most probably an overall loss of security across the organisation. It certainly puts more stress on IT support.
It's not that I'm not security aware - quite the opposite; since my days as a teenage hacker, through the time I worked for a company making cryptographic thingies for people in funny hats, and into my journalistic career where I've taken coffee with Whitfield Diffie and his ilk, I've watched and engaged in the field with some glee. This stuff isn't working properly.
