"If I'm not in, they can log in as me and run the reports," the school's data manager told a new IT hire when asked to change a password she had been using since 1998.
The audit: six-letter passwords, no expiry, and a recent ransomware wake-up call
In 2020 a reader identified by The Register as "Daniel" was hired to replace a two-person IT department at a UK school. He told the paper the prior IT manager had left amid "accounting irregularities" — principally high-end gaming PCs bought with school funds that never arrived on site — and the deputy manager had been dealing with a ransomware incident that left the school's entire network offline for three months. External contractors eventually rebuilt the network and restored from the only available backup, which was months old; the deputy then quit without serving notice.
Asked in his first week to audit the network and deliver a report on how to "get things up to scratch," Daniel uncovered a number of basic weaknesses. Chief among them was the school's password policy: it was set to six letters, with no complexity requirements and no expiry. Daniel reported that users hadn't been forced to change passwords since before the ransomware attack — or, in many cases, ever. The principal approved Daniel's proposed new password policy and ordered an immediate requirement for everyone to change passwords.
The data manager's practical rationale — and the literal password
Not everyone welcomed the change. The school's data manager told Daniel she had used the same password since 1998 and defended the practice because "everyone on staff knew it." She offered a practical reason: "If I'm not in, they can log in as me and run the reports." The password itself, Daniel reported, was the common phrase "letmein" — written on a piece of paper and taped to her desk.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadBacklash, a managerial override, and a written order
As Daniel rolled out the new policy, complaints multiplied. The principal instructed him to direct all enquiries about the password changes to him. According to Daniel, within two days the principal came into his office, "sighed, put his head in his hands, and ordered me to revert the change and to remove the requirement for everyone to change their password." Daniel resisted the order but obtained it in writing.
Nonprofit takeover, reinstatement, and the data manager's exit
The principal left three months after that decision, and a nonprofit took over the school. Daniel's new employers agreed with his original stance and reinstated the password policy he had proposed. The data manager continued to oppose the change; after a meeting with Daniel and the nonprofit's IT director, she chose to take early retirement rather than learn the new systems or change her password.
How technologists, school leaders, and end users respond
- Technologists and security teams: The episode underscores how quickly basic controls — password complexity and forced rotation — can be identified and remediated in an audit, yet still be reversed by nontechnical decision-makers. In this case, the technical fix (new policy and forced password changes) was approved, overruled, then later reinstated when governance changed.
- School leaders and governors: The principal's intervention shows the role of management judgment in operational security choices; here a senior decision to revert a security change was documented in writing, then followed by a leadership change and a policy reversal when the school came under new governance.
- End users and staff: Longstanding habits and local convenience can be powerful drag factors. The data manager defended a decades-old password because it enabled colleagues to run reports in her absence; when confronted with change, she chose early retirement rather than adopting new credentials or systems.
The story recorded by Daniel in The Register's On Call column lays out a compact sequence: a post-ransomware audit finds weak password controls; a push to fix them; immediate user resistance anchored in long-standing practices; a managerial override documented in writing; then a governance change that restores the security measures. It is a reminder that technical fixes are only one part of improving security — they must survive the human and managerial choices that follow.
Original story at The Register: User refused to change her password because everyone already knew it
