Motivate coworkers to use strong passwords

Question

I work for an expanding company, and we are currently establishing a new IT-infrastructure and several company-policies (privacy/safety rules).

One of my biggest concerns is the acceptance of password rules by several of my coworkers in environments where we can't enforce password-regexes and so on. They are in their late 50's and use extremely insecure passwords. The fact that I've been able to gather their passwords (I've never actively gathered them; I just saw them written up in some notes and documents) gives me headaches.

When I confront them about their 5-7 character long passwords (mostly containing some birthdate and initials) I get responses like "I've used this password for many years and never had any trouble!". They even use their "personal passwords" for the work-environment (to be honest, they use it for everything).

I always stand up for the XKCD-Way-To-Password-Security, but fail to raise awareness of the problem for my coworkers. To make it worse, the coworkers I'm worried about just see my concerns as a joke.

We are a developer and provider of high-security physical-access-control solutions, and I am hardly able to motivate my coworkers to behave like an employee of such a high-security company (which is ridiculous).

Normally I wouldn't mind about them using weak passwords. However,

• I see the company's reputation at risk.
• I've already monitored direct attacks against some of our mail-accounts and our firewall.
• The company's data, secrets and customers will be at risk if a leak happens.

So my questions in this context are:

• How do I motivate them on other ways than force them so they keep up the "password-spirit" and not just play along for the time I keep an eye out for the issue?
• How do I best respond to phrases like "I've used this password for many years and never had any trouble!"?
• Should I escalate deniers to my boss (who put me in charge for the password rules and safety)?
  • Should I threaten deniers that I can escalate this to our boss?

I've seen a lot of answers considering the use of two-factor authentication (2FA), etc. I would love to introduce 2FA or hardware tokens for our company, and we are indeed checking ways to implement it.

However, there are environments we can not control, e.g. if we have to use platforms of our customers or suppliers where we need to use a username and password. There we need to rely on safe passwords of our employees.

Answer 1

One place I worked had a very simple method in place.

They would periodically test the end users at random through password hacking and phishing emails.

Anyone who failed had to take the online safety course.... again.

That was enough pain that no actual disciplinary action was needed. Having to retake the course was enough to make them careful.

If you can introduce a policy like this, it will work, especially with older people. I know, I am one.

The reason it works well is that it annoys the heck out of people, but not enough to protest. If they get angry, the reply, is simply. "There was a security breach, you are being retrained, not disciplined".

The goal is to correct the behavior, not to punish.

Answer 2

This is normally handled by forcing the password complexity on the users without any need for a dialogue on the matter.

You don't want to do this, which indicates a security laxness on your part. IT should not blame users for taking the easy route when they have the means to mitigate against it.

I suggest that if you really take security seriously, then you use the normal method of obtaining it in this scenario.

Answer 3

A demonstration may be the most effective technique. Try suggesting they test their passwords against this database of stolen passwords: https://haveibeenpwned.com/Passwords

They can also check their email addresses to see if they have been stolen too: https://haveibeenpwned.com/

Having a password in that database means it will be easy to crack. Having both an email address and password stolen means that there is a very high likelihood of any accounts using them being compromised.

Answer 4

This is a directive that needs to come from the top.

You are in a very difficult position of trying to enforce a policy in which there is going to be a ton of push back from the end users.

I have encountered this very thing and what I found most successful is to employ a strategy that gets top management buy in and have the policy not just pushed down, but making the employees part of the solution (as Smokey The Bear says, "Only you can prevent forest fires")

You've already put the argument into a succinct "pitch" for management:

• companies risk and reputation
• existing incoming threats
• company's legal exposure and liability

You just need to sell it to management to get on board with a security policy you're comfortable with

As for addressing issues with users, consider the following points:

• "Answers" (aka "the policy") should come from their direct manager/supervisor. There's no need for you to field/justify security decisions.

• This policy should be codified within the employee handbook/manual and the Acceptable Use Policy for your organization

• A FAQ should be created that you can easily reference them to that addresses their questions/concerns related to security question; make extra effort to highlight specific questions/answers and why the "old way" is obsolete.

• Advanced security measures (in addition to existing username/password authentication) should be implemented including but not limited to:

  • biometric authentication
  • credential automation
  • two factor authentication

I've said for most of my IT career that security is a methodology,not a product. If people don't buy in (especially from the top), your not going to be successful. Therefore....

If you boss has tasked you with this, you need to have a conversation with your boss to go up and sell the vision/policy/methodology. Without that, you won't be successful.

Answer 5

Use a corporate password manager. This provides a feature that makes the users life easier and encourages the use of passwords that fit policy and allows managers/IT to report on compliance.

Most password managers have a "scorecard" that checks for reused or weak passwords. This can be used to show compliance and coach staff who are not using strong passwords.

This can and should be presented as a convenience or improvement for the users. They are relieved of the burden of remembering so many strong passwords, they need to remember one strong passphrase and possess two-factor code or device.

There are also tertiary benefits such as:

• being able to find old or disused accounts to lock
• if a user leaves the company their access can be quickly curtailed by disabling password manager access then use the password manager to lock/remove their old accounts.
• pre-defining password generation strategies to fit the corporate complexity policy by default
• this is a tool that works now with both modern SSO and MFA options as well as older legacy options. It complements modernization efforts.

Answer 6

[...] we are currently establishing a new IT-infrastructure [...]

Excellent. I would say that this is the perfect moment to include a multi-factor authentication layer to your authentication cycle.

This way you can keep password policies within a reasonable human limit (if you make them switch too often, or make passwords too long or too complicated that'll increase post-it usage as well as the number of calls to support) while still keeping account exposure to a minimum.

Answer 7

Unfortunately, there are many people who will keep using the same simple passwords and it would only take a serious breach to make them realise the importance of changing them. From the context, it sounds like very little short of enforcing strict new password rules will make your employees change. Motivation doesn't sound like it would work alone. There are a few things you could try to ease them into creating more secure passwords though:

• In some companies, employees are obligated to give themselves new passwords every X months. When creating new passwords, your system could have in place a means of judging the complexity of a password to see if the new one is good enough. There is the risk that their password changes just from 'password' to 'Password1', but it could be a start.
• Suggest multi-factor authentication. A user would have to - for example - log in with their password and then be sent a code to their phone to complete the process. Might be overkill, but if you're adamant the employees will not change their ways with text-based passwords, these are among the alternatives left in making your environment more secure.
• Have employee seminars that emphasise the importance of security, not just in passwords, but in other means of keeping data safe. These also serve as an opportunity to explain that data protection laws, not just company policy, insist on employees taking more care with securing data. This might also discourage users from having passwords written down!

As for how do you respond to users who say "I've used the same password for years...", there are a couple of ways to approach this. When a company I previously worked for went through a major expansion (by absorbing a competitor), we adopted new security procedures due to the nature of the other company's work. Some people used the similar excuses to those you might encounter. My response was "Let's be honest, we've either been lucky, or we've simply not been seen as a desirable target by the bad people out there." Sure enough, when news of the expansion went public, there was a noticeable increase in the number of attempted 'intrusions'. Emphasise to your users that the new rules you want to implement are inevitable as a company expands. Offer them a grace period, wherein passwords that do not meet requirements will have to be updated in coming months.

There are of course your everyday analogies as well. I'm in good health, but I'll still take vaccinations before travelling to certain places! My home has never been broken into or burned down, but we still have home insurance.

Escalating to your boss should not be an immediate go-to strategy. I know you say you don't want to force the users to make these changes, but there are ways of simply preventing a user from logging in until they have updated their password. If all else fails, you will have the power to assign the uncaring employees a new password yourself.

In short, you can try encouraging your users with the suggestions above, but if all else fails, remember it's more than just your/their job on the line. Exercise your authority if you have to.

Answer 8

How to motivate team members

How do I motivate them on other ways then force them so they keep up the "password-spirit" and not just play along for the time I keep an eye out for the issue?

You motivate employees in this regard the same way you'd motivate them with regard to any policy or procedure.

1. Define. Clearly define and document a password compliance policy, and get it distributed and socialized along with your other corporate policies and procedures. Naturally you will need senior level buy-in to make this happen.

2. Measure. Set up a system whereby password compliance is periodically audited and the team (not individuals) are given an overall score. It might help politically if this sort of auditing is done by a disinterested party, possibly outside of your immediate organization.

3. Control. Get management to include team password compliance as a metric which drives performance reviews and/or compensation. For example, if less than 20% of users have poor passwords, the team gets a bonus.

This way you avoid blaming anyone, avoid taking the blame, and make it clear what the requirements are and that you are serious about it.

How do I best respond to phrases like "I've used this password for many years and never had any trouble!" ?

The question of whether a password is good enough is not any individual's decision but a matter of policy. So see above.

Should I escalate deniers to my boss (who put me in charge for the password rules and safety)?

Absolutely, but in a structured way. See above.

Should I threaten deniers that I can escalate this to our boss?

No, never make threats. Threats are taken personally. See above.

Technology can help, even with legacy systems

Poor legacy security is not a problem that is unique to your organization. There are at least two approaches I can think of that would help solve the problem.

1. Help users by giving them an enterprise SSO system

   An enterprise SSO system can generate random passwords for all of your legacy systems and remember them for your individual employees. When they need to sign on, they provide the SSO password (or sign on to your network using Active Directory credentials, possibly); the SSO system then accesses their password database and fills in the password field in the legacy application. This sort of solution can be made to work with almost all legacy web-based authentication systems.

   The nice thing is, it isn't additional work for your team; it's actually less work.

   The SSO password itself, of course, can be subjected to whatever password rules you want, because it is a modern system.

2. Put the legacy systems behind a modern gateway

   Your legacy systems are probably already behind a firewall, router, proxy, or other network appliance. Many of these can be programmed to require a password of their own, and you can use modern password rules there. Until they authenticate, they won't even be able to pull up the legacy system's login page. Once they authenticate, they can access the legacy system, using their crap password. The crappiness of the password doesn't matter much at that point because it is protected by that second factor.

Answer 9

Use SSO so that users only have to create/remember 1 secure password for everything at your company.

When you require users to create multiple passwords and change them often they will enviably become lazy and pick poor passwords.

Single-Sign-On should be used across all system you don't want to get hacked. You can enforce the password complexity on your Single-Sign-On authentication system. Single-Sign-On can be expensive and time consume to implement but if your company is serious about security that should be your top priority not shaming your users.

Also, make sure passwords have very long expiration date (at least 1 year) or don't expire at all (see https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes)

Answer 10

Before working on motivating individuals, you must ask if the organization and leadership are motivated to have this issue fixed. You say your boss tasked you with this. Do you know this is important to him? What about management outside of IT?

In small companies or departments often people view the security of many systems as not important because the information is just not very valuable to anyone else except the few who use it. In this case people including leadership feel little motivation in security procedures which make it harder to do their jobs.

Security people by now are mad at me, pointing at all the reasons is a problem. They are correct but that misses the point. This is a motivation problem, not a technology problem.

If your leadership doesn't think this is a problem then you must convince them before you try anyone else.

To convince leadership and later everyone else you need a reason for stronger passwords which they can picture in their heads. Hackers breaking into the company’s customer database may farfetched to them. Do you have regulators who could audit you? What about customer contracts which allow the customer to inspect your facilities? Do you have employees leave to go to a competitor? Find an example which people could imagine happening.

The second step is to make it easy for people to do the right thing. Work harder with your vendors to put in place password validation. Install a password tools on workstations so people don't have to remember passwords. Investigate single sign on systems so people don't need so many passwords. What else can you do to make it easier for people?

Motivation is about marking people want to do something, instead of trying to make them do it.

Answer 11

How do I best respond to phrases like "I've used this password for many years and never had any trouble!"?

Why do they lock their door when they leave home so that a key is needed to open it? If they just close it but not lock it, most likely for long time nobody will go to their door to check if it's unlocked. Then someone will. Would they say "I haven't locked my door for many years and never had any trouble!" up until that day? Would it matter for them for how long nobody checked if their door was unlocked?

In my opinion it would also help if you could drop that "they are in their late 50's and use extremely insecure passwords" mentality (or state openly the link instead of vaguely implying one). Such mentality is unrealistic (in my experience the most horribly easy-going, wishful-thinking, mentally weak, careless category of people I have seen in this area are teenagers and people in their 20s and I bet in your experience too), and reasoning by empty stereotypes will negatively affect your credibility and make it less likely that they will take your concerns seriously (they will perceive that you reason like that even if you don't say anything about their age openly).

All this is under the assumption that all you can do is try to persuade your colleagues. If instead management is with you on this then implementing procedures to actually enforce care about password would be the best, but since your company is having the problem you described I imagine that managers don't care (and they are probably even using equally bad passwords). But tread carefully on this because it's likely that this password problem is the elephant in the room and you are going to be the one who "forced" managers to stop pretending the elephant is not there, which might not earn you many points. Also, if a breach occurs the managers will want to act as if that was unexpected, so don't be the one who was always pointing out that it should be expected.

We are developer and provider of high-security physical-access-control solutions and I am hardly able to motivate my coworkers to behave like an employee of such a high-security company (which is ridiculous). For the same purpose (avoiding to point out an elephant in the room that managers want to pretend they can't see) don't mention any of this and don't even let anyone understand that that's how you feel.