4 ms·

> Password Reuse: 49% of respondents use the same login credentials for multiple work applications, and 36% use the same credentials for personal and profession

> Password Reuse: 49% of respondents use the same login credentials for multiple work applications, and 36% use the same credentials for personal and professional accounts. If your company has multiple things you need to log in to, its doing something wrong. Having company-wide single login system is really critical for good security. > 30% of employees share their workplace passwords with colleagues, effectively nullifying the protections offered by unique credentials or MFA. This also suggests something is setup wrong in the company (lack of giving people correct access?). Normally sharing passwords should be harder than not sharing, if you have to log out of a global account to log in as another one. Security is all about incentives. If employees are incentivized to act insecurely, they will. Its not the employees fault, its the people who setup the system in such a way that encourages people to act insecurely. Good security is all about aligning incentives to control risk.

turbojet1321 2y ago
> If your company has multiple things you need to log in to, its doing something wrong. How does that work for privileged accounts?
- cmckn 2y ago
  Kind of like sudo. Your individual identity is allowed to assume the privileged identity after providing an additional factor/justification (and your access has a TTL).
  - turbojet1321 2y ago
    Sorry, I meant in an actual corporate (ie, Windows) environment, not conceptually.
    - kevindamm 2y ago
      My solution is: don't use AD for anything privileged in production, route all privileged operations through SSO auth and have the operation executed by servers in production. Separate corp and prod. Add a zero trust layer so that every single privileged operation involves an auth challenge (which can be assisted by an OTP dongle so that users aren't required to re-key their passwords multiple times per 20-ish hours).
    - epiecs 2y ago
      You use PIM: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure https://learn.microsoft.com/en-us/entra/id-governance/privil... Basically you are eligible for your admin roles but you have to activate them first. Usually there are additional checks + notifications to other admins. These permissions are also only available for a set amount of time and then you will need to re request them :)
      - sfn42 2y ago
        I don't understand the point of PIM. If some malicious actor has my token or controls my PC then what's stopping them from PIMing? Seems to me like it wastes my time more than anything else.
        epiecs 2y ago
        Good question actually! There are multiple layers that add to the security: - Your login session as a user is normally valid for a day (~10 hours). But a pimmed session that gives you global admin permissions can be for example capped to max 1 hour. - A normal login as a user can just require login + mfa. But if you want to PIM to certain admin roles you for example are required to use your yubikey as well. Yes it's an extra step but if your account is hacked they only have access to you as a user and not you as an admin unless they also capture your security key. Also it creates some additional awareness for admins that they are now handling the keys of the kingdom and that the role that they just activated can do a lot of harm. In some organizations users get an admin account without fully understanding the consequences. - It is way easier to audit. In normal circumstances a user's admin permissions are "always on". Once you start using pim you can also audit when and where additional permissions where requested. This is especially handy when you are monitoring everything and you get an alert saying "Hey sfn42 just requested global admin from a location that they normally do not request this. Can you look into this to make sure that it is legit?" With always on permissions this becomes way harder. - Easier to manage via groups. You can have groups tied to eligible permissions and subsets of permissions. This is really handy once you start having external consultants who can request permissions via IGA (Identity Governance) policies. Basically consultants can go to a url (https://myaccess.microsoft.com/ https://myaccess.microsoft.com/) and request an "access package" that might contain 1 or more roles. For example somebody who has to audit certain items in our organization can request a package that contains the needed admin roles and get automatically added to the correct groups. Once they request that package we can have automated processes (with multiple stages if needed) that first contact the teamlead of that person, and later on maybe another group of person(s) to approve that access. These groups have access reviews done by the security team / app owner (weekly/monthly depending..) to make sure that all accesses are still needed. It is also really easy to let these permissions expire. So our auditor will have a valid account for the entire year but will have to re-request their permissions every 3 months (or whatever we choose). This is also _really_ easy to audit :) - When someone in our security team requests a role the rest of the team automatically receives an email so we know what is going on with our collegues :)
    - tame3902 2y ago
      In my company the official policy is that nobody but the admins gets administrator privileges. If you need them the workflow is that you go to IT and they do what is necessary. Or they just might say no. People had to complain that makes work impossible for them and will cost the company a lot of money so that they got exceptions -- but only after escalation to upper management. I think this was a security directive that came from the top.
sandworm101 2y ago
Maybe if you work at a unitary company with a narrow scope of work. If you have to login to external systems belonging to other organizations, or have terminals for external systems in your facility, unitary identity is not an option.
- strken 2y ago
  Having a centrally administered password manager is usually an option, unless there are regulatory reasons not to.
  - deprecative 2y ago
    I can't get a few of my clients to adopt password managers and they get logged out of their accounts constantly because an employee will change some password to an account the business depends on. These people want to suffer and roll around in fetid filth.
moooo99 2y ago
> If your company has multiple things you need to log in to, its doing something wrong. Having company-wide single login system is really critical for good security. It absolutely is, but it is only applicable to large corporations and won’t help any SMBs. The issue is that this functionality via LDAP/SAML/OODS is frequently locked behind enterprise subscription tiers that usually represent an extremely high markup over other paid tiers. Even in larger corporations, it often not possible to have SSO everywhere. We have multiple „shadow IT“ subscriptions for services that only our team uses. Most of them don’t offer SSO functionality, even for those who do a user base of 5 people is not going to be sufficient to have someone from the responsible departments deal with it. So we have passwords
- methou 2y ago
  FreeIPA and Authentik works pretty well for me, I did some of this for my self with terraform for fun. Personally I don’t think it’s viable SMB who can’t hire a couple of sysadmins. But the documentation for FreeIPA is especially good. Personally wouldn’t use samba as windows DC, but one legacy windows server license seems reasonable if you are having a few hundreds of employees. In a previous job we’ve done Windows DC + Azure AD + FreeIPA + FreeRadius just fine, the entire setup is not super complicated, but still a headache. I think nowadays most of the thing can be terraformed so it could be easier and more scalable for growing SMBs.
  - moooo99 2y ago
    Oh absolutely, I am not talking about the provider side. Sure, it is not trivial, it is doable to set up a central directory and maintain it for relatively affordable. The problem is with the software you are using. A lot of SaaS software has the connection to an SSO provider locked behind an enterprise tier. Take Figma as an example. Their Pro tier is 15€/mo, their Organization tier is 45€/mo. A 3x markup for the lowers tier that supports SSO. And that is among the more reasonable prices. I’ve seen markups of 10x for an enterprise tier that is essential a pro tier + SSO.
    - Helmut10001 2y ago
GoblinSlayer 2y ago
>36% use the same credentials for personal and professional accounts Does Big Tech even allow multiple accounts? When watsapp asks a phone number to register, what do you type?
throwawayian 2y ago
You don’t work in IT. Unless you’re paying for Okta and Office365 and Workspace, you’re only getting maybe 70% of systems _you know about_. And don’t get me started on automated provisioning or deprovisioning.
jjav 2y ago
> If your company has multiple things you need to log in to, its doing something wrong. It is inevitable. The SSO tax is often very high and for some products very difficult to justify. And then of course the large tail of smaller vendors that just don't support any SSO period. > Normally sharing passwords should be harder than not sharing Talk to marketing, they all share passwords to all the company media accounts because it is often the only way, those vendors don't support anything else.

turbojet1321 2y ago

> If your company has multiple things you need to log in to, its doing something wrong. How does that work for privileged accounts?

cmckn 2y ago
Kind of like sudo. Your individual identity is allowed to assume the privileged identity after providing an additional factor/justification (and your access has a TTL).
- turbojet1321 2y ago
  Sorry, I meant in an actual corporate (ie, Windows) environment, not conceptually.
  - kevindamm 2y ago
    My solution is: don't use AD for anything privileged in production, route all privileged operations through SSO auth and have the operation executed by servers in production. Separate corp and prod. Add a zero trust layer so that every single privileged operation involves an auth challenge (which can be assisted by an OTP dongle so that users aren't required to re-key their passwords multiple times per 20-ish hours).
  - epiecs 2y ago
    You use PIM: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure https://learn.microsoft.com/en-us/entra/id-governance/privil... Basically you are eligible for your admin roles but you have to activate them first. Usually there are additional checks + notifications to other admins. These permissions are also only available for a set amount of time and then you will need to re request them :)
    - sfn42 2y ago
      I don't understand the point of PIM. If some malicious actor has my token or controls my PC then what's stopping them from PIMing? Seems to me like it wastes my time more than anything else.
      - epiecs 2y ago
        Good question actually! There are multiple layers that add to the security: - Your login session as a user is normally valid for a day (~10 hours). But a pimmed session that gives you global admin permissions can be for example capped to max 1 hour. - A normal login as a user can just require login + mfa. But if you want to PIM to certain admin roles you for example are required to use your yubikey as well. Yes it's an extra step but if your account is hacked they only have access to you as a user and not you as an admin unless they also capture your security key. Also it creates some additional awareness for admins that they are now handling the keys of the kingdom and that the role that they just activated can do a lot of harm. In some organizations users get an admin account without fully understanding the consequences. - It is way easier to audit. In normal circumstances a user's admin permissions are "always on". Once you start using pim you can also audit when and where additional permissions where requested. This is especially handy when you are monitoring everything and you get an alert saying "Hey sfn42 just requested global admin from a location that they normally do not request this. Can you look into this to make sure that it is legit?" With always on permissions this becomes way harder. - Easier to manage via groups. You can have groups tied to eligible permissions and subsets of permissions. This is really handy once you start having external consultants who can request permissions via IGA (Identity Governance) policies. Basically consultants can go to a url (https://myaccess.microsoft.com/ https://myaccess.microsoft.com/) and request an "access package" that might contain 1 or more roles. For example somebody who has to audit certain items in our organization can request a package that contains the needed admin roles and get automatically added to the correct groups. Once they request that package we can have automated processes (with multiple stages if needed) that first contact the teamlead of that person, and later on maybe another group of person(s) to approve that access. These groups have access reviews done by the security team / app owner (weekly/monthly depending..) to make sure that all accesses are still needed. It is also really easy to let these permissions expire. So our auditor will have a valid account for the entire year but will have to re-request their permissions every 3 months (or whatever we choose). This is also _really_ easy to audit :) - When someone in our security team requests a role the rest of the team automatically receives an email so we know what is going on with our collegues :)
  - tame3902 2y ago
    In my company the official policy is that nobody but the admins gets administrator privileges. If you need them the workflow is that you go to IT and they do what is necessary. Or they just might say no. People had to complain that makes work impossible for them and will cost the company a lot of money so that they got exceptions -- but only after escalation to upper management. I think this was a security directive that came from the top.

sandworm101 2y ago

Maybe if you work at a unitary company with a narrow scope of work. If you have to login to external systems belonging to other organizations, or have terminals for external systems in your facility, unitary identity is not an option.

strken 2y ago
Having a centrally administered password manager is usually an option, unless there are regulatory reasons not to.
- deprecative 2y ago
  I can't get a few of my clients to adopt password managers and they get logged out of their accounts constantly because an employee will change some password to an account the business depends on. These people want to suffer and roll around in fetid filth.

moooo99 2y ago

> If your company has multiple things you need to log in to, its doing something wrong. Having company-wide single login system is really critical for good security. It absolutely is, but it is only applicable to large corporations and won’t help any SMBs. The issue is that this functionality via LDAP/SAML/OODS is frequently locked behind enterprise subscription tiers that usually represent an extremely high markup over other paid tiers. Even in larger corporations, it often not possible to have SSO everywhere. We have multiple „shadow IT“ subscriptions for services that only our team uses. Most of them don’t offer SSO functionality, even for those who do a user base of 5 people is not going to be sufficient to have someone from the responsible departments deal with it. So we have passwords

methou 2y ago
FreeIPA and Authentik works pretty well for me, I did some of this for my self with terraform for fun. Personally I don’t think it’s viable SMB who can’t hire a couple of sysadmins. But the documentation for FreeIPA is especially good. Personally wouldn’t use samba as windows DC, but one legacy windows server license seems reasonable if you are having a few hundreds of employees. In a previous job we’ve done Windows DC + Azure AD + FreeIPA + FreeRadius just fine, the entire setup is not super complicated, but still a headache. I think nowadays most of the thing can be terraformed so it could be easier and more scalable for growing SMBs.
- moooo99 2y ago
  Oh absolutely, I am not talking about the provider side. Sure, it is not trivial, it is doable to set up a central directory and maintain it for relatively affordable. The problem is with the software you are using. A lot of SaaS software has the connection to an SSO provider locked behind an enterprise tier. Take Figma as an example. Their Pro tier is 15€/mo, their Organization tier is 45€/mo. A 3x markup for the lowers tier that supports SSO. And that is among the more reasonable prices. I’ve seen markups of 10x for an enterprise tier that is essential a pro tier + SSO.
  - Helmut10001 2y ago

GoblinSlayer 2y ago

>36% use the same credentials for personal and professional accounts Does Big Tech even allow multiple accounts? When watsapp asks a phone number to register, what do you type?

throwawayian 2y ago

You don’t work in IT. Unless you’re paying for Okta and Office365 and Workspace, you’re only getting maybe 70% of systems _you know about_. And don’t get me started on automated provisioning or deprovisioning.

jjav 2y ago

> If your company has multiple things you need to log in to, its doing something wrong. It is inevitable. The SSO tax is often very high and for some products very difficult to justify. And then of course the large tail of smaller vendors that just don't support any SSO period. > Normally sharing passwords should be harder than not sharing Talk to marketing, they all share passwords to all the company media accounts because it is often the only way, those vendors don't support anything else.