Re: Any IT people with a lot of passwords?

[billd]

OK – here’s why some of those won’t work.

I can only choose MY passwords for my own accounts. For SQL admin, server admin, routers, well, you get the drift – it’s not MY choice meaning that someone ELSE assigns the passwords and ID.

That means to log in to a router, it might require a different user ID than to get into SQL – and each will have different passwords, none of which would be my choosing.

I could end up having to track 6 different login names, and that many or more passwords, all of which will change routinely, then my own, of course.

Further – to get caught writing them down on paper means disciplinary action, possibly even termination – it would look really bad with my title “network security administrator” don’t you think? LOL

We can’t use the “secure ID” sort of system with the card or stick as for our own accounts and many others, it validates against active directory – meaning that it’s a static ID for that user, but the password is in active directory (Windows networking) for 60 days when it expires and you must change it. I’m not really too concerned about my own passwords I use for daily work, even the password I”ll use for administrative duties, it’s more for the password protecting other items.

I’ll have an ID and password I use daily for ordinary work, etc. – it will be basically my name and a password of my choosing, and will expire every 60 days. That I can figure like I’ve always done with a mix and I just change parts of it each time.

I’ll have an ID and password for my work where elevated privaliges will be needed – server updated, maintance, installing or configuring software on servers, and so on. Same as above, but more secure, and more of “god right” to the network.

Then there will be the ID and passwords for SQL databases – not my choosing, but still need to know them.

There will be ID and passwords for routers and switches – as long as they are connected to the network and can access an ACS server, I can use my ID and password – but if the network connection is lost (which is one reason I’d get into them) then I have to use a different ID and password not of my choosing.

There will be passwords that different server services will use to launch and run, and those will change……

It’s going to be a mess, but it’s required. Frankly, I’m one of the persons who pushed for this security, besides the fact that it’s being required for our SSA info, and the state central IT is moving that direction. I’ve told them for years that passwords that never change are a huge risk, especially if someone leaves. Using the same password for all means that if one thing is hacked, then it all is.

For home use passwords and personal accounts, I can choose ID and password – but then, one should never ever use the same id and/or password for multiple things as if someone ends up hacking on, they have everything. If they hack your email and guess id and password, then they have your ebay account. If you share eBay ID and password with paypal, and they get into eBay, then your paypal is history, and so on.

I won’t put anything in “the cloud” – I know too much about it and how it works….. and the fact you have no clue where those servers are, who has access, etc. Doing so for the state would be a direct violation of multiple policies, and for us to get information from the SSA (social security administration) for our client services, we must show that we don’t store any information on non-government sites –

REPORT ABUSE