3 ms·
A thing that I found missing is that legacy systems' influence is much larger than only the systems it directly touches. Through particular requirements that s
by SCHiM 6y ago
A thing that I found missing is that legacy systems' influence is much larger than only the systems it directly touches.
Through particular requirements that some of these systems have they might shape policy too!
I primarily deal in security assessments of networks. Guess what happens to your password strength requirements if somewhere deep down in a dark and old server room there is a mainframe that can only handle 8 character lowercase passwords? Assume that this system has been the backbone of your, then hyper-modern, completely integrated IAM system for decades?
...
That's right, security policy mandates 'simple' 8 character passwords... Not ideal.
- tonyedgecombe 6y agoThat sounds like my last bank. I used a 16 character password but could login with the first 8 characters and it wasn't case sensitive. Every time I interacted with them there were hints that things weren't quite right and sure enough they ended up in the news after a huge IT failure.
- cthonicthulu 6y agoShudder. That's horrifying enough to make me want to wall off that whole thing in a VPN which in and of itself has a stronger password, and expose access to it from a proxy.