GNER prints passwords in customer magazine

Train operator Great North Eastern Railway (GNER) has inadvertently printed system passwords in a magazine available to thousands of passengers.

The April/May edition of Livewire, GNER's passenger magazine, includes an article on the operator's control centre in York.

The article is illustrated with a series of photographs, one of which shows mainframe and computer passwords written on a whiteboard.

William Higgins, editor of Livewire, says inclusion of the picture was a mistake, and that GNER's technology team has worked to rectify any problems.

Martin Grey, technical services manager in GNER's information systems department, says passwords were changed before the magazine was published.

'The procedure in terms of our internal security was not being followed and we took quick steps to remedy that,' he said.

'We quickly changed the passwords and user accounts so no one outside could get into our corporate data.'

A GNER spokesman also confirmed passwords were no longer being written on the whiteboard.

The company carries 15 million passengers every year, eight million of whom are business travellers. The magazine has a circulation of more than 100,000.

Phil Robinson, chief technology officer at security specialist Information Risk Management, says individuals should keep passwords to themselves.

'Mainframes are a sensitive part of any organisation and contain the crown jewels of data a business might want to protect,' he said.

Robinson says it is unusual to see passwords written on whiteboards, but users regularly write security information on a Post-it note stuck to their monitor.

He suggests ground rules for companies to make passwords secure.

Businesses need to ensure users are aware of policy, and that individuals choose passwords that are both secure and reasonably easy to remember.

Companies should enforce a lock-out policy that prevents individuals from accessing the system for a set period of time after a specified number of wrong password entries.

Robinson says firms need to carry out local checks to ensure users do not use weak passwords.