Burned by Eschewing Best Practices

DustinB3403

I'm sure this has been discussed before, but don't store user passwords, don't request them, don't mandate users tell them, and don't set them to something and never allow them to be changed.

If as a domain administrator you need to get into a user profile to "have access" use your administrative credentials.

Passwords.

RojoLoco

@DustinB3403 said in Burned by Eschewing Best Practices:

I'm sure this has been discussed before, but don't store user passwords, don't request them, don't mandate users tell them, and don't set them to something and never allow them to be changed.

If as a domain administrator you need to get into a user profile to "have access" use your administrative credentials.

Passwords.

That thread makes me think that after all is said and done, bad management + spineless IT guy = they will keep on having that master list of passwords.

DustinB3403

@RojoLoco Yeah I figure as much, which this will just open a "he said she said" issue if something with legal ramifications occurs.

DustinB3403

Um... why is this a question again? Decision: To stay physical or move to vitual

Dashrender

I had a client that maintained a password list for every employee once. I showed the boss how this was completely unnecessary, she didn't change.

Dashrender

That question reminds me of a post yesterday or so about a PCI auditor claiming to need that same info... WTF?

RojoLoco

@DustinB3403 said in Burned by Eschewing Best Practices:

Um... why is this a question again? Decision: To stay physical or move to vitual

Posts like that make me think SW makes their staff create puppet accounts to post such nonsense so they will have something to feature, because apparently they have been scrambling for feature worthy posts lately.

brianlittlejohn

I like the first line of the post... "I didn't find much searching..." I call BS... lol

scottalanmiller

@brianlittlejohn said in Burned by Eschewing Best Practices:

I like the first line of the post... "I didn't find much searching..." I call BS... lol

LOL. There is a lot of that.

travisdh1

@brianlittlejohn said in Burned by Eschewing Best Practices:

I like the first line of the post... "I didn't find much searching..." I call BS... lol

If they only tried the search available on the site rather than a Google site search, I might not outright laugh at them, only on the inside.

coliver

@Dashrender said in Burned by Eschewing Best Practices:

I had a client that maintained a password list for every employee once. I showed the boss how this was completely unnecessary, she didn't change.

At my last position they wouldn't let me enforce password complexity because there was a password list the managers wanted to keep to.

DustinB3403

Keeping systems and data around for extremely long periods of time leads to major issues. Like having to keep all records available..

"As long as records are retained, they are legally discoverable, regardless whether their retention period has expired." - from the American Bar Association.

Dashrender

@DustinB3403 said in Burned by Eschewing Best Practices:

Keeping systems and data around for extremely long periods of time leads to major issues. Like having to keep all records available..

"As long as records are retained, they are legally discoverable, regardless whether their retention period has expired." - from the American Bar Association.

yeah, people just don't get that until they get burned by it. We have people who have email that goes back 20 years... it's just crazy to me.

But when my boss goes and digs out some email from 5+ years ago.. she loves to come and say.. See I needed this thing from 5+ years ago, it's a good thing I kept it.

DustinB3403

@Dashrender said in Burned by Eschewing Best Practices:

@DustinB3403 said in Burned by Eschewing Best Practices:

Keeping systems and data around for extremely long periods of time leads to major issues. Like having to keep all records available..

"As long as records are retained, they are legally discoverable, regardless whether their retention period has expired." - from the American Bar Association.

yeah, people just don't get that until they get burned by it. We have people who have email that goes back 20 years... it's just crazy to me.

But when my boss goes and digs out some email from 5+ years ago.. she loves to come and say.. See I needed this thing from 5+ years ago, it's a good thing I kept it.

Exactly, but the thing that immediately comes in in court is "oh hey you have evidence that shows favor in this light etc, give us everything from then?"

scottalanmiller

@Dashrender said in Burned by Eschewing Best Practices:

But when my boss goes and digs out some email from 5+ years ago.. she loves to come and say.. See I needed this thing from 5+ years ago, it's a good thing I kept it.

And you should properly respond "We got lucky that no one did a legal discovery, too." Remind her, every time, that she's "gotten lucky" from being risky. It's not just that keeping data makes you vulnerable, it also means that you HAVE to keep all data. You can't pick and choose what gets kept. It's all or nothing.

scottalanmiller

@DustinB3403 said in Burned by Eschewing Best Practices:

@Dashrender said in Burned by Eschewing Best Practices:

@DustinB3403 said in Burned by Eschewing Best Practices:

Keeping systems and data around for extremely long periods of time leads to major issues. Like having to keep all records available..

"As long as records are retained, they are legally discoverable, regardless whether their retention period has expired." - from the American Bar Association.

yeah, people just don't get that until they get burned by it. We have people who have email that goes back 20 years... it's just crazy to me.

But when my boss goes and digs out some email from 5+ years ago.. she loves to come and say.. See I needed this thing from 5+ years ago, it's a good thing I kept it.

Exactly, but the thing that immediately comes in in court is "oh hey you have evidence that shows favor in this light etc, give us everything from then?"