Washington Policy Brief > Personal Use of Work Passwords Expose Government IT Systems

Personal Use of Work Passwords Expose Government IT Systems

January 05, 2012

The Arizona Department of Public Safety (Arizona DPS) is urging workers to stop using agency passwords on non-work websites. The warning followed an attack in late December by the group Anonymous in which it leaked the passwords and credit card data of federal subscribers to intelligence publisher Stratfor.

According to an article in Nextgov.com, Arizona DPS spokesman Carrick Cook stated that Anonymous allegedly unlocked state government systems by stealing and reusing the passwords officers used to access their personal e-mail accounts and non-work websites.

Former Anonymous member Jennifer Emick said some of the functioning passwords came from explicit websites, where police had registered using their government e-mail addresses and government passwords. Hackers were able to use those user names and passwords to sign on to the Arizona DPS databases.

Cook, on the other hand, said he didn't know all the details, but one gateway for hackers was the officers' personal web mail accounts. Cook noted that some police had forwarded work e-mails, which displayed their computer credentials, to their personal accounts. "Once they [the hackers] got into the work email system – into the mainframe – they could get into the server," Cook said.

According to the article, Cook stated that police were instructed to create stronger passwords that contain a certain number of characters, letters, and numbers. Additionally, officers are prohibited from using any personal account passwords as government logins and must contact the system administrator or enter a current password to change their codes.

Nextgov.com reported that the FBI has arrested roughly 20 “cyber crooks” aligned with Anonymous over the last year and that the current attack was a result of the group’s anger over Arizona’s immigration policies.

The article noted that Stratfor's investigation and coordination with law enforcement is ongoing. Chief Executive Officer George Friedman wrote the following on the company’s Facebook page: "We are diligently investigating the extent to which subscriber information may have been obtained."

For more, visit the original source:

Washington Policy Brief

The Washington Policy Brief is an online advisory that contains brief summaries of recent legislative and regulatory issues that may affect the records and information management profession. Further information about the issue is accessed by clicking on the link provided at the end of each summary.

Want to sign up to receive an e-mail version of the Washington Policy Brief? It's free! Just tell us a little about yourself and you'll receive a monthly dose of the latest in legislation, regulation, and more.