?
Solved

Security Concern: Usernames in Email Addressed

Posted on 2007-03-28
2
Medium Priority
?
264 Views
Last Modified: 2011-09-20
Our organization currently assigns email accounts for our staff using their username…

Example: If the username is smith123, then their email address is smith123@ourcompany.com

When we consider security, we now realize this isn’t the preferred method of assigning email accounts. Now the decision/question is do we…

A) Reassign email accounts, change all the business cards, contact everyone that has our emails addresses on record and hope they update their records… OR

B) Change the usernames, make changes in all the programs the reference these usernames in hardcode, watch for any anomalies and hope nothing is failing ‘under the hood.’

Another option/question is how vulnerable are we to leave things the way they are? If passwords consist of eight complex characters (a-z,A-Z,0-9, !-$), would bumping this up to 10 charters be the ‘easy’ solution?
0
Comment
Question by:todjklki
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 27

Accepted Solution

by:
Tolomir earned 252 total points
ID: 18809649
I would simply start with additional official email addresses.

like firstname_surname@company.com (or j.sixpack@company.com)

The now active email addresses could be kept, just when it's time to make new business cards use the new email address. Also change the signatures in your emails to match the new email-addresses.

After a year or two the "old" email addresses will be forgotten by your business partners, within company you can use them as long as you wish.

Tolomir
0
 
LVL 32

Assisted Solution

by:r-k
r-k earned 248 total points
ID: 18812288
Good advice from Tolomir. I just want to add that IMO a 10-char password is always much much better than an 8-char password. In fact length of the password is much more important than the complexity, so long as single dictionary words and common names are avoided.

Whether you should change the email addresses right-away or use Tolomir's suggestion depends on your particular security requirement. In a highly secure environment, probably yes, but other steps such as firewall, lock-outs, password length etc. are surely more important than hiding usernames.
0

Featured Post

Need protection from advanced malware attacks?

Look no further than WatchGuard's Total Security Suite, providing defense in depth against today's most headlining attacks like Petya 2.0 and WannaCry. Keep your organization out of the news with protection from known and unknown threats.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Provide an easy one stop to quickly get the relevant information on common asked question on Ransomware in Expert Exchange.
Did you know that more than 4 billion data records have been recorded as lost or stolen since 2013? It was a staggering number brought to our attention during last week’s ManageEngine webinar, where attendees received a comprehensive look at the ma…
Have you created a query with information for a calendar? ... and then, abra-cadabra, the calendar is done?! I am going to show you how to make that happen. Visualize your data!  ... really see it To use the code to create a calendar from a q…
How to fix incompatible JVM issue while installing Eclipse While installing Eclipse in windows, got one error like above and unable to proceed with the installation. This video describes how to successfully install Eclipse. How to solve incompa…
Suggested Courses

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question