Re: Password security

[Joel Rosenblatt <joel () COLUMBIA EDU>]

Hi,

We do not keep any unencrypted UNI passwords - we are using Kerberos for all of our passwords - I question the validity of the vendors statement "no one else 
in higher education is encrypting passwords" - what is the context for this?  The encryption applies to our University Ids.

I do not know what vendors like Apply Yourself are doing internally, but I guess I will find out.

My 2 cents

Joel Rosenblatt

Joel Rosenblatt, Manager Network & Computer Security
Columbia Information Security Office (CISO)
Columbia University, 612 W 115th Street, NY, NY 10025 / 212 854 3033
http://www.columbia.edu/~joel
Public PGP key
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x90BD740BCC7326C3



--On Tuesday, January 31, 2012 11:00 PM +0000 "Palmer, Kevin" <kpalmer () CCIS EDU> wrote:

> Colleagues,
>   I apologize in advance for the cross listing, but it was suggested that this list may have some interesting responses 
> to this issue.
>
>   I have a question regarding a very large third party CRM vendor.  As expected, the vendor allows users 
> (leads/applicants) to set up password-protected
> accounts to enter in general and sensitive information about themselves and eventually use this and additional 
> information to submit an application to the
> institution.  We (Tech staff) have recently learned that the user passwords are stored in clear text, and are available 
> to the employees in admissions who
> work on the system.
>
>   We have asked about encrypting the passwords, and the vendor has told our folks that no one else in higher education 
> is encrypting passwords and that it
> would be difficult, leading our admissions/enrollment management folks to question whether or not this is a "best 
> practice".  I think it is simply being
> prudent, and that there is no reason for anyone to know another persons' authentication credentials.  What are your 
> thoughts?  Is this over-the-top security?
>
> Best regards,
> Kev
>
> Kevin Palmer
> Chief Information Officer
> Columbia College
> 1001 Rogers Street
> Launer 9
> Columbia, MO 65216
> (573)875-7329
> kpalmer () ccis edu<mailto:kpalmer () ccis edu>
> www.ccis.edu<http://www.ccis.edu/>
>
> [Description: Description: Description: Description: Description: Description: Description: Description: 
> CC_logo_4c_colorbuild_lg]



Joel Rosenblatt, Manager Network & Computer Security
Columbia Information Security Office (CISO)
Columbia University, 612 W 115th Street, NY, NY 10025 / 212 854 3033
http://www.columbia.edu/~joel
Public PGP key
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x90BD740BCC7326C3