I work for an expanding company, and we are currently establishing a new IT-infrastructure and several company-policies (privacy/safety rules).
One of my biggest concerns is the acceptance of password rules by several of my coworkers in environments where we can't enforce password-regexes and so on. They are in their late 50's and use extremely insecure passwords. The fact that I've been able to gather their passwords (I've never actively gathered them; I just saw them written up in some notes and documents) gives me headaches.
When I confront them about their 5-7 character long passwords (mostly containing some birthdate and initials) I get responses like "I've used this password for many years and never had any trouble!". They even use their "personal passwords" for the work-environment (to be honest, they use it for everything).
We are a developer and provider of high-security physical-access-control solutions, and I am hardly able to motivate my coworkers to behave like an employee of such a high-security company (which is ridiculous).
Normally I wouldn't mind about them using weak passwords. However,
- I see the company's reputation at risk.
- I've already monitored direct attacks against some of our mail-accounts and our firewall.
- The company's data, secrets and customers will be at risk if a leak happens.
So my questions in this context are:
- How do I motivate them on other ways than force them so they keep up the "password-spirit" and not just play along for the time I keep an eye out for the issue?
- How do I best respond to phrases like "I've used this password for many years and never had any trouble!"?
- Should I escalate deniers to my boss (who put me in charge for the password rules and safety)?
- Should I threaten deniers that I can escalate this to our boss?
I've seen a lot of answers considering the use of two-factor authentication (2FA), etc. I would love to introduce 2FA or hardware tokens for our company, and we are indeed checking ways to implement it.
However, there are environments we can not control, e.g. if we have to use platforms of our customers or suppliers where we need to use a username and password. There we need to rely on safe passwords of our employees.