Need a Password? Just Call the Help Desk

A simple policy change on handling lost passwords solves a complex problem at Jude's company

By Jude Thaddeus

January 1, 2001 12:00 PM ET

Computerworld - Passwords are a constant source of problems in my organization. They're irritating, they're obtrusive, they're constantly being forgotten, and they don't even provide a good level of security. Long-term, I'm trying to replace our Windows passwords with smart-card access, but until that happens, we've got to cope with passwords.
Our current problem is at our help desk. When Joe User forgets his password, all he has to do is call the help desk and they'll reset it for him. You have to offer this service - legitimate users are forever forgetting their passwords, and you have to have a way to let them back into the system.

This Week's Glossary
X Window System: A multitasking, windowing graphical user interface program that runs on a Unix host for communicating between X terminal devices and Unix host systems.

X terminal: A terminal connected to the X Window System that presents a window-based user interface to the user and allows the user to access multiple applications at the same time.
For the more technical reader, here are the details of three security risks that our scanner identified on four of our systems, with information about how to remedy them:

• A remote host shouldn't allow trusted access from the scanning machine. This trust may extend to other inappropriate machines as well. Examine the .rhosts file and ensure that it contains a list of only those machines that should be trusted.

• Open X Window displays allow an attacker to capture keystrokes and to execute commands remotely. Many users have their X server set to "xhost +," permitting access to the X server by anyone, from anywhere. Either issue an "xhost -" command to deny access to everyone and selectively allow only trusted hosts to connect with xhost + commands, use a cryptographically secure authentication protocol such as xauth, or remove X Window.

• The inverse query feature supported on some domain name servers (DNS) shouldn't be used. An attacker can use this feature to obtain a zone transfer. Zone transfers identify every machine registered with your DNS and can be used by attackers to better understand your network. The zone transfer occurs even if you've disabled zone transfers on your server. Configure your DNS to disable inverse queries.

But what's to stop me from calling the help desk pretending to be Joe User and getting someone to reset his password and tell it to me? Not a lot - as long as I can convince them that I'm Joe User, they'll tell me his

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Additional Resources

POLL RESULTS

Leading IT Pros Weigh In on Top IT Issues

Accelerate your knowledge of the IT world you inhabit by viewing the results of a series of polls taken by your IT peers. These polls of 100+ IT professionals each are available for full viewing. They cover key topics such as virtualization, processor performance, green IT, cloud computing and many others. Be a part of the buzz.

WHITE PAPER

For Best Results, Think Beyond the Box

Technology is complex. Keeping it running productively shouldn't be. To that end, you want to minimize the number of solutions needed in-house to simplify operations, maintenance, and support. Kodak offers a best-practices model. One company provides support for both scanner and software, for fast problem resolution without vendor finger-pointing. Download now!

WHITE PAPER

Accelerating the Path to Demand Intelligence with a Demand Signal Repository

Utilizing demand intelligence improves the precision of pricing, product assortments, channel/store placement, and promotion, which are all essential for sustainable revenue management performance. Learn more, download this free whitepaper today.

White Papers & Webcasts

An SMB's Guide to ECM Software
Learn how to choose an ECM solution that helps increase productivity, provide better customer service, and automate time-consuming, paper-based processes....

Managing And Protecting Your Ever Increasing Mobile Assets
Learn best practices for desktop and application virtualization, computer security, and computer life-cycle management....

File Integrity Monitoring: Secure Your Virtual and Physical IT Environments
Learn how integrity monitoring software solutions enable IT organizations to achieve and maintain configuration control. Tripwire® Enterprise is the first solution to effectively...

IDC Webcast: Linux Adoption in a Global Recession
Join Al Gillen from IDC and Michael Applebaum from Novell in this on-demand webcast to see how Linux has emerged as an even...

Enterprise Application Delivery: No User Left Behind
Enterprises need the ability to deliver applications, with the appropriate levels of performance and security to all users, using any device, across any...

Novell Opens PR Video
Is the Linux desktop for me? Customers are looking for ways to be more flexible and save money. Using Linux offers a great...

The CIO's New Guide to Design of Global IT Infrastructure
Is it possible to eliminate the impact of distance? This paper explores the 5 key principles successful CIOs are using to redesign IT...

2 Minutes to IT workload automation
Take just 2 minutes to watch this short CONTROL-M flash video. Well show you how BMC CONTROL-M can put money back into your...

Business Value of Performance IDC Whitepaper
Are you looking for a comprehensive solution that addresses insufficient or congested bandwidth, impaired application performance, slow remote backup and replication or obstacles...

Security Configuration Management
In this web video, follow along with Jim Hansen, Senior Product Manager with Big Fix, as he explains why Security Configuration Management is...

All White Papers | All Webcasts