Security is About Passwords and Credit Cards

Security is About Passwords and Credit Cards. That's what a very nice lady told me a few months ago. At first I shrugged it off. Of course security is so much more than that. As I started to process it though I realized that is exactly what it is about to end-users. They don't care about the LMCompatibilityLevel, renaming admin accounts, UAC, SafeDllSearchMode, restricted tokens, or IDM. All they care about is to keep their credit cards safe, and the way they do that is by using a password. In the end, I started writing an article on it. When I was done, it was a three-installment piece. The first one just hit the web in the July issue of TechNet Magazine. Let me know what you think.

Published Fri, Jun 20 2008 2:27 PM by jesper
Filed under:

Comments

# Stefaan Pouseele said on 21 June, 2008 12:58 PM

I just love it...

What I have learned in more than 30 years in ICT is that the interface User - ICT is the most important thing. KISS (keep it simple and stupid) is the keyword.

Kindly,

Stefaan

# Geo. said on 23 June, 2008 03:46 AM

I use different passwords for those very few sites that, in my opinion, require that level of security. That is probably about 10-15% of the total of all sites that ask for login details.

I use the same login details for all the rest which brings me to the point; I perceive that a major part of the problem is the plethora of sites that require login details for non-security related reasons, for example, many on-line stores require login details before they even let one view their products. Time enough for that if I decide to buy. I liken it to having to swipe a card to enter a streetfront store. There are numerous websites that require a password, etc for no apparent reason. Suffice it to say that I have reached the stage where, when I encounter such sites these days, I just go away again.

# Dmitry said on 28 June, 2008 10:38 AM

Jesper is back. Thank you for this article. It reminds me your best presentations I was listening to at TechEd(s).

Yes, end user needs is the key.Any security solution should be validated by this principle.

2Geo - these sites try to build their user base. This is normal (but sometimes can be annoying - one recent example is experts-exchange).