Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 19 subscribers
  • Views 14744 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Passwords

taekwanleap

I have something I have been wondering about I wanted to throw out for discusssion.

If your organization has a network password policy that creates the framework for users to create strong passwords, but yet the user still creates a weak password given complexity requirements of the network password policy, if the weak password is cracked, who is liable?

Here is my thought process.  According to HIPAA Security and Privacy rule, if there is a data breach, depending on how that breach occurs, it could be the company/organization who is liable but it could also be the employee who is liable.  As most of you well know, there are currently doctors, nurses, etc. who have been fired, lossed their license, fined fees/penalties and currently serving jail/prison time for HIPAA violations due to data breaches.

They have to determine who is liable - the company or the employee - but one of them will be liable.  Maybe both depending on the case.

So for instance, a doctor who has access to a patients medical record access that medical record without having a need to do so can be fired, lose their license, fined and possibly go to jail for the unauthorized access.

If the organization has the correctly policy and procedures in place that satisifies the HIPAA guidelines and can prove they provided enough, adequate security and awareness training, the organization would not be found liable - but the employee would.  The employee would be subject for being fied, losing their license, paying fines and possibly jail.

So following the same thought process.  If your organization has a Network Password Policy that provides the framework, guidelines for them to create strong passwords but the employees still chooses to create a weak password meeting your complexity requirements.  If their password is cracked and is the cause of a data breach, who would be liable?  Would the employee be liable for creating the weak password which violates the Network Password Policy and could they be faced with fines, penalties, etc?

For instance, our Network Password Policy outlines the password complexity requirements and gives specific examples to avoid dictionary type passwords, keyboard sequence passwords, etc.  The idea is to create a strong password meeting the complexity requirements.  But they could still create a weak, dictionary type password meeting the complexity requirements.  They have been instructed to not take a word out of the dictionary and modify it because that is still considered a dictionary password.

Now, not really debating if passwords are the be all, end all solution to stopping or preventing data breaches.  Nor am I saying passwords no matter their length and strength can't be hacked or broken into.

Just wanting to know if an employee fails to follow your policy and procedure regarding network passwords and the password is hacked - could the employee be personally liable as in other HIPAA violations they could be held liable for?

The example I give our employees is to through the entire alphabet into a bowl in uppercase letters.  Then throw the entire alphabet into the same bowl in lowercase letters.  Then through in the number 0-9.  Then throw in all punctuation marks.  Then throw in all symbols and special characters.  Stir and shake the bowl up real good.  Reach in and grab 8 to 14 characters and randomly place them in a row in front of you - that is what your password should look like.

:25655


This thread was automatically locked due to age.
Parents
  • 0

    Hello takewanleap,

    what should be the result of the discussion (not that I don't find the topic interesting, on the contrary)? This is a legal question - common sense won't help. Not knowing HIPAA in detail it's also hard to make reasonable comments.

    Note: when talking about employees I refer specifically to medical personnel, not IT staff.

    The first question that come to my mind is - does HIPAA assume that any data breach can be avoided or is data breach defined as avoidable (the what's the exact definition of avoidable) disclosure of data? Does it also apply if an employee is forced to hand over a password or data at gunpoint? Or - assuming a powerful and dedicated attacker  who just "outguns" your security?

    Now to get to more common scenarios - policies have parts which can be directly enforced (such as password rules) and parts which can not (like "don't write down your password"). IMO just setting up complexity requirements without enforcing time (which is doable) falls - from a technical point of view - short. You shouldn't only forbid weak passwords but reject them. If you don't have the technical means to do that - what about the rest of security?

    Furthermore (permit some simplification) - you can crack only passwords where you either have access to the encrypted data. the encrypted password or a means to verify the password by repeated try. The latter two cases should not be possible - if they are it is IMO clearly the responsibility of the organization, weak password or not. This leaves encrypted documents only - and here only those cases where the user also carries the decryption key - protected by a user-defined (one that can be chosen without validation) password - around. Dunno if this is permitted under HIPAA - I don't think it is necessary.

    Thus I think that the technical state-of-the-art enables the organization to enforce password rules and an employee (as s/he should not be able to choose a "weak" password) should not be liable. Accidental or negligent disclosure is of course a different matter.

    To summarize - a successful crack can only occur if data is leaked (primarily the organization's liability, the leak itself - say, of an encrypted document - might be the employee's fault), password hashes are exposed (organization), the system allows "unlimited" password attempts (clearly organization) or encryption keys can be stored externally by the employee and protected with an arbitrary password (IMO organization).   

    But as said - the legal system likely has a different view.

    Christian

    :25669
Reply
  • 0

    Hello takewanleap,

    what should be the result of the discussion (not that I don't find the topic interesting, on the contrary)? This is a legal question - common sense won't help. Not knowing HIPAA in detail it's also hard to make reasonable comments.

    Note: when talking about employees I refer specifically to medical personnel, not IT staff.

    The first question that come to my mind is - does HIPAA assume that any data breach can be avoided or is data breach defined as avoidable (the what's the exact definition of avoidable) disclosure of data? Does it also apply if an employee is forced to hand over a password or data at gunpoint? Or - assuming a powerful and dedicated attacker  who just "outguns" your security?

    Now to get to more common scenarios - policies have parts which can be directly enforced (such as password rules) and parts which can not (like "don't write down your password"). IMO just setting up complexity requirements without enforcing time (which is doable) falls - from a technical point of view - short. You shouldn't only forbid weak passwords but reject them. If you don't have the technical means to do that - what about the rest of security?

    Furthermore (permit some simplification) - you can crack only passwords where you either have access to the encrypted data. the encrypted password or a means to verify the password by repeated try. The latter two cases should not be possible - if they are it is IMO clearly the responsibility of the organization, weak password or not. This leaves encrypted documents only - and here only those cases where the user also carries the decryption key - protected by a user-defined (one that can be chosen without validation) password - around. Dunno if this is permitted under HIPAA - I don't think it is necessary.

    Thus I think that the technical state-of-the-art enables the organization to enforce password rules and an employee (as s/he should not be able to choose a "weak" password) should not be liable. Accidental or negligent disclosure is of course a different matter.

    To summarize - a successful crack can only occur if data is leaked (primarily the organization's liability, the leak itself - say, of an encrypted document - might be the employee's fault), password hashes are exposed (organization), the system allows "unlimited" password attempts (clearly organization) or encryption keys can be stored externally by the employee and protected with an arbitrary password (IMO organization).   

    But as said - the legal system likely has a different view.

    Christian

    :25669
Children
No Data
Unfiltered HTML