de Poel Director:
There can be no guarantees that the senior management would even know as all it needs is an individual to have the logon details to be able to make an entry. However they appear to have addressed this by allowing the driver the opportunity to contest it.
A- Yes, there are guarantees. The system does not allow junior staff members to enter such information.
de Poel Director:
I can name at least 3 transport offices where the passwords for the system are securely held on bright yellow post it notes stuck to the monitor
A- We believe this to be inaccurate. However please feel free to contact me directly with their details and I will have them removed from the system until such time as there security improves. If this where the case no records are viewable without the presence of the drier in question anyway.
ROFLMAO. I wouln’t trust you with the security of the Gents Loo. Junior Staff WILL manage to get access to the system using their bosses logon. This is even more likely to happen in a small office with a couple of staff in…like my agency branch.
And how are records not viewable without the driver present? Is there some system in place that requires the driver to enter his/her login details which don’t actually exist because you’ve commented that your IT staff are morons and incapable of setting up such a simple system?
I am seriously concerned about the faith you are placing in your customers in regards to abuse of the system.
Here’s a bit of a lesson for you…
http://www.windowsecurity.com/articles/Passwords_Network_Security.html
Password Vulnerabilities
The big vulnerability of passwords lies in their nature. There are several different ways that a person can “prove” his/her identity:
- Providing something they know (the password)
- Providing something they have in their possession (such as a card)
- Providing something they are (a physiological characteristic such as a fingerprint)
- Providing something they do (such as speaking for voice pattern analysis)
Because the password is something you know, that knowledge can be gained in different ways. Unlike with a key to a lock, which is a physical object, an intruder doesn’t have to take the password away from its owner in order to have it himself. Instead, he can get it in one of several ways (without the owner ever knowing). For example:
- Exploitation of weak passwords: Left to their own devices, users often choose “easy” passwords — ones that they can remember without much trouble. This means they use a word, phrase or number that has special meaning to them, such as their spouse’s name, their birthday or social security number. An intruder who knows something about the user may be able to guess the password. Use of any word that is in the dictionary creates vulnerability, because “brute force” methods (trying one password after another until you hit the right one) and “dictionary” attacks can crack them.
- Exploitation of user behavior: If the password is more complex and non-intuitive (a random combination of letters and numbers), the user may have trouble remembering it, and this may lead to writing it down — often keeping it in a prominent place such as the top desk drawer or even on a sticky note stuck to the monitor. Users may also share their passwords with other users in an informal work environment. Even when users exercise reasonable diligence, hackers can often use “social engineering” to persuade users to divulge their passwords by posing as tech support or administrative staff.
- Capture of credentials in transit: Even when strong passwords are used and users keep the passwords to themselves, savvy intruders may be able to capture the credentials when they are sent across the network if sufficient security measures aren’t in place to prevent this.
Because there are so many ways for an unauthorized person with a little technical knowledge and/or people skill to learn the passwords of legitimate users, it is very important that organizations launch a multi-faceted defense against password breach. That begins with mandating that only secure passwords be used.