User refused to change her password because everyone already knew it

School staff seemed to be trying to get ransomware – for a second time

Change is constant, but The Register likes to keep some things the same – such as using Friday mornings to bring you a new installment of On Call, the reader-contributed column that shares your tech support stories.

This week, meet a reader we'll Regomize as "Daniel" who told us that in 2020 he was hired to replace a two-person IT department at a UK school.

"The IT manager had left amid some 'accounting irregularities,' mainly involving high-end gaming PCs being purchased using school funds but never making it onto the school site," Daniel told On Call. "His deputy stepped up just in time to have to deal with a ransomware attack that took the school's entire network offline for three months."

REG AD

The school eventually hired external contractors to rebuild the network and restore from the only available backup, which was months old. The deputy IT manager then quit without serving their notice period.

REG AD

Daniel took the vacant job and in his first week the school principal asked him to audit the network and deliver a report explaining how to get things up to scratch.

"I found a few quick wins, including the password policy which at the time was set to six letters. Just that, no complexity, no expiry," Daniel told On Call. "And users hadn't been forced to change them since before the ransomware attack. Or, indeed, ever."

The principal approved Daniel's proposed password policy and a requirement for everyone to change their password immediately.

"I was not prepared for the backlash this would create," Daniel wrote. The school's data manager proudly said she had used the same password since 1998 and justified keeping it on the grounds that everyone on staff knew it.

"She said, 'If I'm not in, they can log in as me and run the reports.'"

It gets worse: the password was "letmein" and the data manager had written it on a piece of paper and taped it to her desk.

As Daniel rolled out the new password policy, more complaints rolled in.

The school principal eventually told Daniel to direct all enquiries regarding the password changes to him.

REG AD

"Within two days, he came into my office, sighed, put his head in his hands, and ordered me to revert the change and to remove the requirement for everyone to change their password," Daniel wrote.

"I resisted, I really did," he wrote. "But it was his school. I got him to put the request in writing."

The principal left three months later, and a nonprofit took over the school.

Daniel's new bosses agreed with his stance and reinstated his password policy.

The data manager again fought the change.

"After a meeting with me and the nonprofit's IT director, she decided to take early retirement, so she wouldn't have to learn the new systems – or change her beloved password."

Have management or users rejected your advice? Click here to tell us what happened, and your story could appear in a future edition of On Call. ®