Re: Interesting Research

["Von Welch (Work)" <von () VONWELCH COM>]

Ron,

 I’m curious as to your risk acceptance process around research on campus. Do your VCR/VPR or CIO play a role in risk 
assessment and acceptance in this case?

Thanks,

Von

--
Von Welch
Director, Center for Applied Cybersecurity Research / cacr.iu.edu <http://cacr.iu.edu/>
Pervasive Technology Institute / Indiana University
vwelch () iu edu <mailto:vwelch () iu edu> / (812) 856-0363


> On Apr 2, 2019, at 4:01 PM, King, Ronald A. <raking () NSU EDU <mailto:raking () NSU EDU>> wrote:
>
> Fellow security pros,
>  
> I have an interesting research request come in my inbox today. A researcher wants to setup a portal for students to 
> self-register with a username and password. The kicker is passwords will be stored in plain text and collected. The 
> premise is to gauge whether students are actually adhering to suggested practices in password design.
>  
> My first reaction is “(heck) no,” but I realize I may be overreacting. So, I decided to see if anyone has dealt with 
> this kind of research and how you handled it.
>  
> While I see the value in the research, my security senses tell me students will be using their standard password they 
> use for everything. Thus big risk.
>  
> Feel free to contact me directly.
>  
> Thank you,
> Ron
>  
> Ronald King
> Chief Information Security Officer
>  
> Office of Information Technology
> (757) 823-2916 (Office)
> raking () nsu edu <mailto:raking () nsu edu>
> www.nsu.edu <http://www.nsu.edu/>
> @NSUCISO (Twitter)
> <image001.png>