289
Users when we lock the office door for 10 minutes to have a meeting (lemmy.ca)
submitted 2 years ago by [M] to c/techsupportmemes@lemmy.ca
11 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 12 points 2 years ago (1 child)

This in addition to giving users passwords from hell if they refuse to use self-service.

pwgen 32 what a great friend you have been

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 9 points 2 years ago (2 children)

    Refusal isn’t an option they have. Usage of MFA and SSPR is required to work, they will not have access to company systems unless they comply. That is the rule at any company that takes data security serious at all.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 2 years ago (1 child)

    Every 3 months my company just increments the last digit.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 2 years ago (1 child)

    I mean, that’s what lots of users do. My state requires that all state employees change their password every 90 days. This just means everyone has an incrementing number at the end of their password. Because the idiot users just write it on a fucking sticky note, which totally negates the idea of password changes.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 9 points 2 years ago (1 child)

    Regular password changes haven’t been recommended procedure for several years now. The only problem it solves is preventing people from using the same password everywhere, but since everyone just sticks a number at the end anyways it doesn’t actually protect against that either

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 years ago (1 child)

    As someone who worked for an MSP, not all customers believe that they require these security measures. Especially smaller companies would jest they were too small to be a hacking target.

    Many users would call in saying their users didn't work, while in truth their password was expired. We would tell them to use the sspr, and they would call back 10-15 min later and say that the sspr didn't work. So instead of going through the steps to troubleshoot something in front of them, to prove that they were lying, we would set pwgen passwords and depending on when they called and their attitude we had a scoring system and use their score for the pwgen command. After some time of doing this, fewer users would call in and more of them would learn to use the sspr

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago

    Yea MSPs can’t do this because they typically support a bunch of businesses so small they barely need anything and aren’t worth attacking because there is no money to ransom. My comment is from the major Corp IT perspective

  • permalink
  • fedilink
  • source
  • parent