To put the problem in perspective, it would be the same kind of problem of impersonation as if a member of your staff were falsely accused of damaging company records, sending inappropriate e-mail within the company or to external recipients or posting inappropriate materials on a company Web page. Not only would the victim of the impersonation suffer – so would the company.

Although I realize you probably know this perfectly well, for the record, I will assert that:

1) The problem is not the individual help desk agent's: she was courteous and professional and doing her job as she was instructed to do it. She deserves no blame.

2) IMNHO,* The SpinalTap system, not the help desk, should have a mechanism for resetting the password by ASKING THE USER the authentication questions on screen before e-mailing a one-time password to the officially registered e-mail account for recovery.

3) The idea that a phone call supposedly from a user (but potentially from a social engineer) is an acceptable basis for resetting has been discounted decades ago. In the absence of automated password resets, the only acceptable mechanism for secure re-authentication of an employee is to have the user physically come to the help desk or to a proxy for recognition or for documentary identification and authentication using a company-issued photo ID. Possibly you can get around this requirement in a distributed environment by using Webcams, but there are security issues there too because of the uncertain integrity of digital imagery. However, for an external customer who cannot reasonably show up at your offices, you must develop a social-engineering-resistant methodology like the simple approach using pre-established e-mail addresses which is already implemented by uncounted numbers of Web sites.

I recommend that the written procedures for coping with loss of a password on the SpinalTap system be analyzed by the company help desk managers and corrected. If there are no written procedures, I will help write some for you that conform to industry best practices at my usual consulting rates.

Best wishes, Mich

* IMNHO = in my never-humble opinion

M. E. Kabay, PhD, CISSP-ISSMP, is Program Director of the Master of Science in Information Assurance program at Norwich University.