The need for policy

With any security solution, there is a need for policy. As part of a company's security awareness training, users should be educated about the value of host keys and made aware of a company's procedure for checking host keys. Clearly communicating this policy can alleviate a lot of the fear, uncertainty, and doubt that accompany users' decision-making when a new host key is presented.

Administrators should understand that changing host keys could have a ripple effect. In the case where a host key must be changed, the change should, if at all possible, be communicated to users of the service in advance of making it. By doing so, much of the help desk grief can be eliminated.