Solved

Security Concern: Usernames in Email Addressed

Posted on 2007-03-28
2
253 Views
Last Modified: 2011-09-20
Our organization currently assigns email accounts for our staff using their username…

Example: If the username is smith123, then their email address is smith123@ourcompany.com

When we consider security, we now realize this isn’t the preferred method of assigning email accounts. Now the decision/question is do we…

A) Reassign email accounts, change all the business cards, contact everyone that has our emails addresses on record and hope they update their records… OR

B) Change the usernames, make changes in all the programs the reference these usernames in hardcode, watch for any anomalies and hope nothing is failing ‘under the hood.’

Another option/question is how vulnerable are we to leave things the way they are? If passwords consist of eight complex characters (a-z,A-Z,0-9, !-$), would bumping this up to 10 charters be the ‘easy’ solution?
0
Comment
Question by:todjklki
2 Comments
 
LVL 27

Accepted Solution

by:
Tolomir earned 63 total points
ID: 18809649
I would simply start with additional official email addresses.

like firstname_surname@company.com (or j.sixpack@company.com)

The now active email addresses could be kept, just when it's time to make new business cards use the new email address. Also change the signatures in your emails to match the new email-addresses.

After a year or two the "old" email addresses will be forgotten by your business partners, within company you can use them as long as you wish.

Tolomir
0
 
LVL 32

Assisted Solution

by:r-k
r-k earned 62 total points
ID: 18812288
Good advice from Tolomir. I just want to add that IMO a 10-char password is always much much better than an 8-char password. In fact length of the password is much more important than the complexity, so long as single dictionary words and common names are avoided.

Whether you should change the email addresses right-away or use Tolomir's suggestion depends on your particular security requirement. In a highly secure environment, probably yes, but other steps such as firewall, lock-outs, password length etc. are surely more important than hiding usernames.
0

Featured Post

ScreenConnect 6.0 Free Trial

Want empowering updates? You're in the right place! Discover new features in ScreenConnect 6.0, based on partner feedback, to keep you business operating smoothly and optimally (the way it should be). Explore all of the extras and enhancements for yourself!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In every aspect, security is essential for your business, and for that matter you need to always keep an eye on it. The same can be said about your computer network system too. Your computer network is prone to various malware and security threats t…
Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question