Before I hung up my white coat, I was a family doctor at a CLSC in downtown Montréal. Every month, the system asked me to change my password. This message was usually preceded by several others warning me that the password would have to be changed in x days.
I had gotten into the habit of ignoring them.
It’s a law of nature that the final message, like a Windows update, always arrives at the worst possible moment.
It usually happened when I was busy and tired. I had possibly just spent 24 hours in the hospital delivery room catching babies, and I had 14 phone messages to return, four faxes to send, illegible reports to decipher and people waiting for me in the waiting room.
When I started at the CLSC, the system administrator had given me a “temporary” password. For all practical purposes, I kept it for 5 years.
It was something like “samhar01”.
There was a rule preventing the reuse of recent passwords. But I quickly realized that once I got to samhar09, I could start over at 01. It was very convenient.
The problem is that I had never considered the risk this posed, and nobody ever brought it up with me.
Recently, an anonymous source sent a photo to Hackfest. This person had gone to a CLSC in the Québec City region. At the front desk sat a computer. On it, the passwords were clearly displayed. Really, plainly visible. They hadn’t been scribbled on a Post-it. No. Someone had gone to the trouble of doing a nice job.
I contacted the CISSS (Centre intégré de santé et de services sociaux, the integrated health and social services centre). Ms. Maryse Rodrigue, from the communications department, replied that the CISSS “[ regularly ] reminds employees about the confidentiality of access codes and passwords, and that there is a policy on this matter.”
The spokesperson also assured me that there would be a follow-up “to rectify the situation”.
The goal here is not to point fingers at the employee who stuck their password on the computer. It is risky behaviour. Unfortunately, experience shows that the more restrictive certain rules and practices become, the more people find ways to get around them. Moreover, training on “why” this behaviour is risky is often lacking.
I asked Vincent Tremblay, a cybersecurity specialist and Hackfest organizer, whether organizations should require their employees to change their passwords often. He told me that “password policies are a double-edged sword. Too complicated? People will do anything to bypass them or just won’t care, and we’re back to square one. Too simple, but you have to change it too often? You can expect ticket #1 to be ‘I forgot my password and it won’t let me change it’.”
So, what do we do?
The solution lies in awareness and education. Authentication isn’t there to annoy us, but to protect highly sensitive and confidential data. Understanding the “why” is essential. Because yes, if we don’t understand its importance, security is often perceived as an obstacle.
While we wait for “passwordless authentication”, we can drop certain outdated practices and use passphrases, relaxing the rules on password complexity and frequent rotation.
Above all, we need to create an environment where employees have the time they need to devote to good information security practices.
We could also stop using the fax machine, but that’s a topic for another day.
