Perhaps you think your company’s IT department is a pain in the ass. Perhaps you think they are drunk with power on their ability to impose seemingly arbitrary security requirements upon you and your co-workers.
Perhaps you are a great big whiner.
You could have it much worse, you see. You could work for the Texas Attorney General’s office, whose web portal is evidently maintained by some sort of malevolent brain in a jar. How else could you explain this draconian set of password guidelines? I don’t know what kind of conversations people have in that office, but I bet they go something like this:
EMPLOYEE: Hey, Carl? Can I talk to you for a second?
BRAIN IN A JAR: I AM TO BE ADDRESSED AS SYNAPTOR!
EMPLOYEE: Right. Um, well, listen, either way, people are having some trouble resetting their passwords.
BRAIN: THE PROCESS IS QUITE SIMPLE.
EMPLOYEE: Well, some of us were wondering if maybe you could loosen the rules a bit.
BRAIN: IMPOSSIBLE. SECURITY IS PARAMOUNT.
EMPLOYEE: Well, Doug really wanted to use DougTexa$ and —
BRAIN: ERROR! ERROR!
EMPLOYEE: What? Why?
BRAIN: NUMERAL NOT PRESENT. FINAL CHARACTER MUST NOT EQUAL $. PASSWORD MUST BE GREATER THAN EIGHT CHARACTERS. NAMES ARE TO BE AVOIDED. WORD: “TEXAS” DISALLOWED.
EMPLOYEE: Okay, well, what about Kara? She wanted to use —
BRAIN: IMPOSSIBLE.
EMPLOYEE: I didn’t even tell you her password!
BRAIN: MY TELEPATHIC ABILITIES ARE QUITE FORMIDABLE.
EMPLOYEE: You’re a dick, Carl.
BRAIN: SYNAPTOR.
That password scheme at the OAG is likely their attempt to
satisfy two or more information systems’ password requirement (RACF, Microsoft,
and various government entities, etc) It’s also a sign that there’s no
cooperation in-between.
The worst part of these crazy password schemes is that they’re
usually tied to a ridiculously short mandatory password change interval, like
every 60 days.
“I finally remembered my insanely difficult password and
now it says it’s expired! *hammer/face/hammer/blackness*
I’ve worked for several state agencies in an IT capacity (I am
Synaptor). Supporting user password issues all the time makes a person
apathetic to maintaining heightened security awareness, the thing the password
policy is meant to account for!
Disclaimer: I, of course, strictly adhere
to any security policy I’m asked to support, as they are all well thought out
and great!