Password security

Kev,

You should post this on the Educause Security Listserv. I am sure that the responses would, at the very least, be amusing. We encrypt.

Thanks,

Frank

Colleagues,

  I apologize in advance for the cross listing, but it was suggested that this list may have some interesting responses to this issue.

  I have a question regarding a very large third party CRM vendor.  As expected, the vendor allows users (leads/applicants) to set up password-protected accounts to enter in general and sensitive information about themselves and eventually use this and additional information to submit an application to the institution.  We (Tech staff) have recently learned that the user passwords are stored in clear text, and are available to the employees in admissions who work on the system.

  We have asked about encrypting the passwords, and the vendor has told our folks that no one else in higher education is encrypting passwords and that it would be difficult, leading our admissions/enrollment management folks to question whether or not this is a “best practice”.  I think it is simply being prudent, and that there is no reason for anyone to know another persons’ authentication credentials.  What are your thoughts?  Is this over-the-top security?

Best regards,

Kev

Kevin Palmer

Chief Information Officer

Columbia College

1001 Rogers Street

Launer 9

Columbia, MO 65216

(573)875-7329

kpalmer@ccis.edu

www.ccis.edu

I don’t think it’s over the top; it’s basic.  The passwords should be hashed using a strong password hashing scheme that uses salts and key stretching (not plain MD5).

As you point out, if the passwords are in plain text, the admissions folks and possibly others can see their passwords.  An attacker who compromises the system may also be able see them.  The threat is primarily to the students, not the institution.  People reuse passwords.  An user with access to those passwords (authorized or not) can use them along with the students’ other information to compromise accounts the students have on other systems: Facebook, email, banking, etc.  If the password is used for access to other college systems, then having a student’s password would also allow someone to potentially access information not in the original application (grades, student email, financial aid).  Plaintext passwords are bad.

There should also be a mechanism in place for restricting who can see certain information such as social security numbers. 

Best regards,

Encrypting passwords is essential for basic system security. It isn’t just best security practice: I think it would be challenging to talk about system security in any context where passwords were not encrypted.  

I Have to agree with Joel and Robert. That statement took me by surprise and the vendor should be considered suspect.

Good Luck!

Confidentiality Note:  This email is intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information.  If you are not the intended recipient(s), any dissemination, use, distribution or copying is strictly prohibited.

Would this happen to be ApplyYourself?  I had a very similar conversation with them several months ago, and if I am not mistaken there was some discussion here as well.

Hi Roger,

  Being that this is an open list, I prefer not to name the vendor but will send it to you off-line.

Thanks

Kev

IMHO, and not trying to be confrontational here, that only benefits the vendor, who, gets to hide in anonymity, and then give the same story to the next person who contacts them.  One of the advantages of a list such as this is that it can put pressure on a company to do the right thing.

That being said, I understand your position. 

I suspect your vendor sends the users their actual passwords instead of a reset when a “lost password request” is made.

I usually try to look at an issue from both sides in order to understand why I might NOT want something, but I just can’t see your vendor’s side on this.   And in all honesty, my initial reaction to what your vendor told you isn’t appropriate to be posted here.  But, from a neurotic –security-person point of view, I’d go one step further.  If your usernames/passwords were stored unencrypted AND ACCESSIBLE as your describe, I’d notify all the account holders to change their passwords (after getting the mechanism properly encrypted).

-Brian

Bryan,

  Excellent point regarding the password change after encryption… we will incorporate into our change plan.

Best regards,

Kev

Passwords must ALWAYS be stored encrypted.

Chip

Chip Eckardt
CIO
University of Wisconsin-Eau Claire
105 Garfield Ave.
Eau Claire, WI 54701
Phone: (715) 836-2381 Fax (715) 836-6001
eckardpp@uwec.edu

For our home grown, Academic Progress Portal solution, we go one step further: We hash passwords, and use different password salts for that hash, so even a DBA w/ full access to the un/pw tables would have a very, very difficult time deriving the passwords of the users.

Security is by design, before code, from day one.

It may be that your vendor should attend Defcon (http://defcon.org ) and / or read “The Web Hacker’s Handbook” (http://goo.gl/rv5K8 ) for some education and a reality check re. actual, day-to-day, widely uses and published, security threats.

My apologies if this sounds snarky, which I don’t mean to be—we are emphatic and passionate about this issue of security first, when it comes to software design.

Respectfully,

Scott Helf, DO, MSIT

Chief Technology Officer-COMP

Director, Academic Informatics

Assistant Professor

Department of Academic Informatics

Office of Academic Affairs

College of Osteopathic Medicine of the Pacific

Western University of Health Sciences

309 East 2nd Street

Pomona, CA  91766

909-781-4353

shelf@westernu.edu

www.westernu.edu

From: The EDUCAUSE CIO Constituent Group Listserv [mailto:CIO@LISTSERV.EDUCAUSE.EDU] On Behalf Of Bill Betlej

Sent: Monday, February 06, 2012 12:42 PM

To: CIO@LISTSERV.EDUCAUSE.EDU

Subject: Re: [CIO] Password security

Absolutely the passwords should be encrypted. It's one of the things on our check-list of evaluating vendor product.

Bill Betlej

Mary Baldwin College

Sorry to pipe in, again, but when would storing passwords in clear text ever be okay?

Maybe I am missing something, but, I have a very, very hard time imagining storing passwords that way.

I.e., consensus, even at the CIO (or CEO, or President Obama level) does not a good or secure system make. Let the tech and security folks determine the correct design, and execute. This is a design / engineering issue, not political or consensus issue.

Don’t mean to start a flame war here, but, clearly, this is something, not just IMHO, but in the abstract, and absolute, needs to be fixed. That, or get “p4wn3d” as the “l33t h4x0rs” might put it.

It is only a matter of time, unless it has already happened…

And Kevin, I 100% agree w/ you that no one should ever know, or be able to derive, another’s’ credentials. That is not only bad, and unacceptable, but, truly, a dangerous software design flaw.

Now that the company knows and has been questioned about it, this may be a liability (read, legal, lawsuits, etc.) issue for the vendor and/or college, should they ever get hacked from inside or out, which, it seems, would be on the level of kiddie script stuff, from what is posted below.

Do you have a Chief Security Officer you can run this one by, Kev?

Respectfully,

-sch

From: The EDUCAUSE CIO Constituent Group Listserv [mailto:CIO@LISTSERV.EDUCAUSE.EDU] On Behalf Of Neal McCorkle
Sent: Monday, February 06, 2012 1:08 PM
To: CIO@LISTSERV.EDUCAUSE.EDU
Subject: Re: [CIO] Password security

I think you should ask them which other school has that software and then write the other schools security officers to see if un-encrypted passwords is ok with them.  I am betting they mostly don't know and I am sure it is something most of them would like to know.

Neal McCorkle
NCSU

Hello Everyone,

I recently wrote a few posts about password security that I think (hope) will be of interest to the list.  One of my primary motivations for writing these posts is that a lot of the advice/best practices that we have seem to be folk wisdom.  Is 8 characters really a good minimum password length?  Why not 7, or 9, or 15?

The posts are on my blog at http://bugcharmer.blogspot.com .  I’m planning to write more on various application security issues, but everything I have so far is about passwords.  I would love feedback, but please respond off-list unless you think it will be of general interest.

In case you want to jump to a specific topic, here are some additional links:

An introduction/history of password security (the post links to an article I published elsewhere)

http://bugcharmer.blogspot.com/2012/06/introduction-to-password-protection.html

What are we trying to prevent?  What is the purpose of password salting/stretching, delay timers, lockouts, etc?

http://bugcharmer.blogspot.com/2012/06/passwords-attacks-and-threats.html

How long should passwords really be? 

http://bugcharmer.blogspot.com/2012/06/how-long-should-passwords-be.html

Rainbow tables aren’t as powerful as people think.

http://bugcharmer.blogspot.com/2012/06/rainbow-tables-not-considered-harmful.html

Regards,

Steven Alexander Jr.

Online Education Systems Manager

Merced College

3600 M Street

Merced, CA 95348-2898

(209) 384-6191

alexander.s@mccd.edu