We’ve discussed a lot of news involving password security over the years, but the following really hammers home the point. Sure, you should have unique passwords that protect your sensitive info, but what about your company? Think about how many gaping holes in security the following scenario presents.
![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
Navigation
Install the app
How to install the app on iOS
Follow along with the video below to see how to install our site as a web app on your home screen.
Note: This feature may not be available in some browsers.
More options
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an alternative browser.
You should upgrade or use an alternative browser.
Password Malpractice: Are You Guilty?
- Thread starter Rich Tate
- Start date
Our company has recently begun the over-the-top password protections. I work in a retail grocery chain, but in the pharmacy. We originally had a 3-digit password that would track what we did with scripts, every single step from even looking up how many scripts were processed that day. But since then, they've introduced a plethora of other steps, including a screensaver on the prescription filling screen itself, which is extremely annoying since more than one person has to use the machine to fill prescriptions as the shifts change.
Anyway, we've gone from having to enter one master login to the system and one 3-digit password to fill a prescription to a master login, the 3-digit code, a reentering of your master login. This wouldn't be so bad except that if you happen to walk away from the screen to help a customer, it locks on you, locking everyone else out of the system until you return to put your 3-digit code in along with your master login. If someone else uses the machine, they have to enter in the multiple passwords as well. Then back to me to do it all again if I touch the machine. It adds an ungodly amount of extra keystrokes (leading to lower efficiency in the Rx-line) during the day.
They make us change our passwords every 2 months, and we have to have an eight or more character password containing a capital letter, a number, cannot contain our name or parts of our name, and it can't be any password used within the last EIGHT password changes.
To keep the line moving and the scripts flowing, we've begun sharing the passwords. It's such a hinderance to productivity that it's not worth the hassle. We are urged to not do this, but the result is less work being done, more hours to do the same amount of work we had prior to the passwords, and frustrations using the system day after day.
And what's at stake? Complete personal information of every customer we fill prescriptions for.
Anyway, we've gone from having to enter one master login to the system and one 3-digit password to fill a prescription to a master login, the 3-digit code, a reentering of your master login. This wouldn't be so bad except that if you happen to walk away from the screen to help a customer, it locks on you, locking everyone else out of the system until you return to put your 3-digit code in along with your master login. If someone else uses the machine, they have to enter in the multiple passwords as well. Then back to me to do it all again if I touch the machine. It adds an ungodly amount of extra keystrokes (leading to lower efficiency in the Rx-line) during the day.
They make us change our passwords every 2 months, and we have to have an eight or more character password containing a capital letter, a number, cannot contain our name or parts of our name, and it can't be any password used within the last EIGHT password changes.
To keep the line moving and the scripts flowing, we've begun sharing the passwords. It's such a hinderance to productivity that it's not worth the hassle. We are urged to not do this, but the result is less work being done, more hours to do the same amount of work we had prior to the passwords, and frustrations using the system day after day.
And what's at stake? Complete personal information of every customer we fill prescriptions for.
Wow, that seems pretty extreme. Would make more sense if when you left it logged you out and then there was a screen where anyone can login. Just locking the systems seems like a huge drop in productivity.
I cannot imagine having to come up with all those passwords either!
I cannot imagine having to come up with all those passwords either!
Say you work in a pharmacy, and you have 3 terminals, all within sight of each other, and have 5-6 people working in about a 3 foot by 10 foot space. According to HIPAA security, you need a password for each individual person, who then logs into the computer to fill each prescription. Each time that pharmacy personnel leaves thats station they need to log off.
Time that by the number of prescriptions filled by each member who fills a prescription on the computer. Each employee could log in and out almost 100 times a day! Would you want to do that at your work? Would you want to be the customer who wants to wait an extra 1:00 minute while whoever is working on your prescription to log in and then off?
Yes, there are work flow work arounds, but work flow is usually not flexible is such hectic environments.
I do expect businesses to keep security, but there needs to be a better way to secure data than typical user name and passwords, since its only as good as the people who keep their usernames and passwords confidential. I think user name/password mixes are just too old of a security patch for what current technology can employ. Fingerprint automatic log in would be wonderful, but that is also easily bypassed. What else is there?
Time that by the number of prescriptions filled by each member who fills a prescription on the computer. Each employee could log in and out almost 100 times a day! Would you want to do that at your work? Would you want to be the customer who wants to wait an extra 1:00 minute while whoever is working on your prescription to log in and then off?
Yes, there are work flow work arounds, but work flow is usually not flexible is such hectic environments.
I do expect businesses to keep security, but there needs to be a better way to secure data than typical user name and passwords, since its only as good as the people who keep their usernames and passwords confidential. I think user name/password mixes are just too old of a security patch for what current technology can employ. Fingerprint automatic log in would be wonderful, but that is also easily bypassed. What else is there?
For some systems i have a secureid keychain (http://www.rsa.com/node.aspx?id=1156), i just use the number showing on that, plus my password, and it's about as secure as anything else, plus i can't give out the password because it changes every minute. If someone steals it, they can't use it without my half of the password. Also since the automatic key change on the secureID effectively changes my password, i don't have to change it.
There is also a usb key module that you just plug in the computer and use with your half of the password.
These are the best methods i've found hardware wise.
The rest of the problem IMO lies in whoever is making the software If it takes a couple seconds to login, i don't see a problem with people having to do it 100 times a day... move mouse to get off the screensaver, put in the usb key or look at the keychain, type 8-10 digits, done.
A lot of the other problems are in roles and usability, I work in the area of custom software in financial and other areas, and a major problem is that the software developers, either through lack of planning, or breakdown in communication, end up not understanding and catering to the workflow of the business.
For instance a good stock trader app, would have built in identification for the assistants, so they can maintain their own login AND act in the capacity of the broker. A system for that pharmacy, would have a fast login/logout process so that many people can use the terminals.
There is also a usb key module that you just plug in the computer and use with your half of the password.
These are the best methods i've found hardware wise.
The rest of the problem IMO lies in whoever is making the software If it takes a couple seconds to login, i don't see a problem with people having to do it 100 times a day... move mouse to get off the screensaver, put in the usb key or look at the keychain, type 8-10 digits, done.
A lot of the other problems are in roles and usability, I work in the area of custom software in financial and other areas, and a major problem is that the software developers, either through lack of planning, or breakdown in communication, end up not understanding and catering to the workflow of the business.
For instance a good stock trader app, would have built in identification for the assistants, so they can maintain their own login AND act in the capacity of the broker. A system for that pharmacy, would have a fast login/logout process so that many people can use the terminals.
That kind of extra security measures aren't simply worth it.
It makes employees unhappy and frustrated, it hinders productivity - it may sometimes even stop the worker from working if he/she can't remember one of the 10 passwords they're supposed to memorize every month.
It all boils down to security paranoia - thinking that you are under constant attack from unknown sources. This obviously is not the case in 99% of cases. As long as you protect your network from global network it's enough. Simple passwords for company network are enough just to recognize the worker.
I've seen so many cases where IT systems have been locked down so good that people can't do their jobs effectively anymore. This hinders the whole operation when workers are working in frustration, bad mood, stress and general rebel against company management.
It makes employees unhappy and frustrated, it hinders productivity - it may sometimes even stop the worker from working if he/she can't remember one of the 10 passwords they're supposed to memorize every month.
It all boils down to security paranoia - thinking that you are under constant attack from unknown sources. This obviously is not the case in 99% of cases. As long as you protect your network from global network it's enough. Simple passwords for company network are enough just to recognize the worker.
I've seen so many cases where IT systems have been locked down so good that people can't do their jobs effectively anymore. This hinders the whole operation when workers are working in frustration, bad mood, stress and general rebel against company management.