Data integrity and security is crucial when you work for a multi-billion dollar company that is as tightly regulated as a health insurer. So we have all kinds of passwords & rules and regs in place to make sure that no unauthorized person accesses something.
The problem is that we have so many systems that need us to provide credentials, and no two systems have the same rules regarding passwords. In a typical workday, I need the following to function at my job — in addition to different usernames for each of the following as well.
- Password to log onto my PC. Changes every 60 days. Cannot repeat previous any of a certain number of passwords.
- Password to log into the HR System to enter my time, print my paystub, or do anything else HR-like. Changes every six months. Cannot ever use a previous password (I think). Must have at least one number.
- Password to the Policy Administration System. 6-8 characters only. Must have at least one number. Must use a different password each time, but can go back to previous passwords.
- Password to the Claims System. 6-8 characters only. Very finicky about what’s allowed and not allowed, and nobody really seems to know what the system will accept.
- Remote Access password (for working from home or out-of-the-office). Consists of a 4-digit PIN (that never changes) and a number I have to read off a token that changes every minute.
- Password for a web-resource that I have access to. It uses a completely different username too. Password is 9 characters long and a mix of numbers, upper- and lowercase letters. Password was randomly assigned by system and cannot be changed. Ever.
In addition, there are multiple files and databases that are locked or password protected, and keeping track of all that can itself be a full-time job. Some deal with this by having a note card listing all the systems and their associated credentials on it. The more conscientious will keep that card in a wallet, but I know some who keep it under their keyboard. Me, I have a post-it note taped to my monitor with a bunch of “clues” on it, sometimes in other languages. (Dad’s paternal grandmother’s maiden name, or “Lex __, Lex Credendi.”
But a bigger problem is coming up with the passwords themselves, especially having worked there almost six years now. I started with my mother’s maiden name. Then my grandmothers’. When I got through my great-grandmothers’, I realized I was running out of family. I used up a whole bunch of church-related terms and objects. (Using vestments or sacred vessels made for fun clues; I just drew out what it was and hoped nobody that stopped by was ever an altar server.)
Fortunately, now, I have several friends who are having children, and I can start using them for password ideas. Maria1, Luke05, and a few others have all made the list. And my clues can get pretty wild too, just for fun. “Maria’s sister’s Godmother’s second son’s Godfather’s younger daughter & birthmonth.” (Special prize to the first commenter who guesses correctly.)
Frankly, I wish our IT gurus could figure out a way to have a single sign-on and authentication process. Life would be much easier. In the meantime, I’ll have to settle for passers-by asking me why I have a combination of hieroglyphics and foreign words scribbled on my monitor.
