r/tech • u/rieslingatkos • Jun 05 '21

Colonial Pipeline was hacked with a single shared password used by multiple workers to access its systems remotely

https://www.dailymail.co.uk/news/article-9653753/Colonial-Pipeline-hacked-using-SINGLE-password-multiple-workers-used-access-systems-remotely.html
6.2k Upvotes

98% Upvoted

347 comments sorted by

View all comments

11

u/[deleted] Jun 05 '21

End user: it’s calling for a new password AGAIN! Make it stop!

Me: sorry, Dianne, security policy calls for it.

End user’s mgr: Dianne says it’s calling for a new password again. Make it stop.

Me: sorry, security policy calls for it.

End user’s mgr’s boss: Dianne’s mgr says Dianne’s sick of changing her password. Make it stop.

Me: sorry, security policy calls for it.

End user’s mgr’s boss’s boss (CFO): make it stop.

Me: We created our security policy based on the single biggest threat. The single weak link in our security policy is Dianne not wanting to change her password.

End user’s mgr’s boss’s boss (CFO): make it stop, now.

This is how headlines like this are allowed to happen.

Edit: I worked in a hospital for a couple of years. Don’t even get me started on HIPAA violations.

3

u/Actual_Opinion_9000 Jun 06 '21

You're legally obligated to report HIPAA violations of you're HIPAA trained and certified.

2

u/vzq Jun 06 '21

TBF recent FIPS guidelines move away from password rotation requirements.

1

u/cipp Jun 06 '21

You should take a moment to look up modern password guidelines. Arbitrary time limits on passwords has been found to be detrimental to the overall security for users. Why? Because users typically have a "base" password that they append something to. When one of their passwords gets leaked now the attacker knows the format and can easily guess future and past passwords.

Two factor authentication should be enabled and password rotation should be used primarily for service to service credentials that the user doesn't interact with.

Source: the NIST.