I :heart: people who don't understand what "computer security" means

[crazdgamer.livejournal.com]

I get a call from a high-level exec's secretary. She says that someone from outside our office is visiting and would like to use a computer. She further states that the high-level exec (her boss) has given the ok on this. She specifies the computer that can be used, and requested that the password of the person who normally uses that computer (who is neither herself or her boss) be changed so the visitor may log in as that person.

I, being mindful of a thing called "information security", was not likely to do such a thing. I suggested to her that the person use an already established guest account on the domain. I provide the credentials to the guest account and wish them on my way.

Minutes later, I hear from my immediate boss that the high-level exec himself called my boss and made the exact same request (change the other user's password) just after I got off the phone with his secretary. End result: My advice was ignored, and the password was changed anyway.

I know I don't have to spell it out here since you guys can figure out why this was such a bad idea, but I'll list it out anyway: The other user's personal e-mail, and departmental files are accessible, password can't be changed back to what it was without one of us manually reseting it (I hate asking "what would you like your password to be?") because of group policy, and there's probably some other things I'm forgetting.

Annoying situation.

Comments

[grayhawkfh.livejournal.com]

I am so sorry...

Fortunately, around here, we don't have that sort of problem. In fact, the last time some nitwit called and tried something like that, my supervisor was standing right behind me as I took the call and patiently explained to the person several times that I was not about to break government IS policy for them.

When I humg up, my supervisor looked at me and said "This is all documented, right?" I replied that it was and gave him the ticket number.

Never did hear anything further from them...

[gilmoure.livejournal.com]

Aaaaaaugh! Just Aaaaaaaaugh!

It's always some stupid upper management prick who thinks the rules don't apply to them, who goes and pokes holes in security. And then IT gets blamed, like that stoopid VA laptop that went missing. Because of that one laptop, Homeland Security has mandated that all government and government related organizations encrypt all devices that leave the premises. Because some politician wants to be seen as 'pro-active' time and money is being spent on a 'social problem' and they're blaming the tech. Sigh.

[vortex.livejournal.com]

There is a thing called Network Security.

It could be that the person, who's pc they wated to use, is under investigation for something by an outside entity (ie. Private investigator, Local Bureau of investigation, FBI, etc.) and they just needed to fish for information to see if that person was involved.

We've had that happen on several occasions at companies I worked for. Maybe that person's wife/husband thinks they are cheating, or they are going through a divorce. Maybe they comitted a crime or were fingered as involved in a crime...

[vaxhacker.livejournal.com]

And wouldn't giving a third party access to mess with the PC taint any evidence that may be found there?

[vortex.livejournal.com]

No, not if the third party is doing the investigating.

For example: (keep in mind that I am making this up as I go so all times and situations are variable)

Consider that Joe Bob robs Bank A with Sam from down the road. The cops know someone was with Sam but don't know who, so they start questioning Sams friends. One of Sams friends says that Joe Bob admitted to him in an e-mail long ago that he and Sam were going to do something like rob a bank. The cops could use that e-mail evidence...but, Joe Bobs company doesn't retain Tape backups for more then a week, so they no longer have those e-mails...but, Joe Bob might still have them in his deleted folder. So, the cops go to the Judge, the Judge gives them a specific Search warrant and Violat! Cops Computer forensics person is at Joe Bobs computer looking for those e-mails from a couple of weeks ago...

[eightofspades.livejournal.com]

Erm.

Last time I looked into forensics, even if the third party is the forensic investigator, by logging on as the user they are ruining the chain of custody.

However, I agree that the scenario you posit is possible, just that they were doing it wrong. If your scenario were the case, they were probably logging in to look first, where (hopefully) if they were to find something they would re-investigate using proper forensic procedures. Not that that isn't still incorrect, but...

OTOH, many such investigations never make it to court, ruining the need for chain-of-custody. Informal.

---

IMO, though, that isn't the case here anyhow.

[eightofspades.livejournal.com]

To summarize:

Chain-of-custody in a computer forensic case requires that you can show the judge that the device in question has the incriminating data in question and has not been tampered in any way shape or form since the moment of investigation. In my opinion, the parent poster was correct.

[vaxhacker.livejournal.com]

That's what I was thinking, plus if it were the FBI or police, they'd probably just seize the computer and haul it to the forensics lab. They wouldn't do anything to alter the drive like running apps as the user. But I didn't get the impression that it was anything like that, just some random person who needed the machine. So in the case of someone non-official "investigating" the situation, you'd never be able to say if the evidence was from the employee or the visitor's actions.

[bekscilla.livejournal.com]

Isn't that called "the HP way"?

[vortex.livejournal.com]

It's called that, but things like that still have to work their way up, then down from the CEO...unless it involves the CEO, then it comes down from the Ethics department...

[crazdgamer.livejournal.com]

From what I was told, the visitor only needed internet access, which the guest account could provide.

I seriously think I need to write a precisely worded e-mail to the guy and CC some of my bosses. Yeah, the guy *could* fire me, but I would be remiss in my responsibilities if I didn't address the issue.

[vortex.livejournal.com]

"From what I was told, the visitor only needed internet access,"

That's what you were "told". There are a lot of things that go on without your knowledge. Just because we are IT doesn't mean we are involved with all of IT...

is under investigation for something by an outside entity

[irishmasms.livejournal.com]

There are proper & published industry standards for computer forensics to investigate such situations. The scenario described above is NOT the proper course of action to do such an investigation; in fact you just compromised any evidence you might have found on that box.

Investigation over - have a nice day.

Re: is under investigation for something by an outside entity

[vortex.livejournal.com]

Can you not read?

"For example: (keep in mind that I am making this up as I go so all times and situations are variable)"

The above scenario is just an example, a for instance, not a technical description of how things work.

Also, since you are the expert, how is the evidence in the above example compromised? They got the court to give them a search warrant, they showed up at the company with their computer forensics person and they searched the computer with possibly a company Executive, The investigative cop and the Computer forensics person who is also a cop...how is that evidence going to be rebutted in a court of law?...

Re: is under investigation for something by an outside entity

[eightofspades.livejournal.com]

If you were making it up, you shouldn't've acted as the authority.

Because the device was manipulated before the device was brought into the court of law. Computer forensics requires that any manipulation be done on a reproducible copy of the device for this reason. Hence why forensics teams have raw drive cloning devices.

Re: is under investigation for something by an outside entity

[vortex.livejournal.com]

I wasn't acting as the authority!

I was giving an Example, a hypothetical situation. Why are you guys getting all bent out of shape on this? *Sheesh*...

Re: is under investigation for something by an outside entity

[irishmasms.livejournal.com]

No, you were acking like an asshole - so do not be surprised when we flame you back.

Re: is under investigation for something by an outside entity

[vortex.livejournal.com]

You are the one acting like an Asshole.

I was happy and jolly when I replied to this thread...in fact, I am happy and Jolly now!

Ha Ha Ha!

Ho Ho Ho!...

Re: is under investigation for something by an outside entity

[irishmasms.livejournal.com]

Can you not read?

Re: is under investigation for something by an outside entity

[vortex.livejournal.com]

"The scenario described above is NOT the proper course of action to do such an investigation; in fact you just compromised any evidence you might have found on that box.

Investigation over - have a nice day."?...

[megpie71.livejournal.com]

Even in cases like that, I'd suspect that in the US, there's rules about searching computers. I believe there's actually a constitutional amendment about it, isn't there? Something about search and siezure powers?

(I'm an Australian. I'm therefore not too far up on the US constitution).

Over here, you'd need a signed warrant for the police to be able to enter the premises in the first place. You'd then need another warrant (or a clause in the initial warrant) stating exactly what needed to be searched, and when. And oddly enough, if the police were investigating something like that, I have a strong suspicion that the IT department would already know about it.

Then again, we have some rather strong and nasty privacy laws, which mean that if anyone is handing over your information, you're entitled to know about it.

[vortex.livejournal.com]

See my example posted in this thread, I mention all of that.

The IT department doesn't need to be notified of the purpose, especially if it comes down from the CEO or some other High Level Exec. They just need to know that person A needs access to computer A using person B's login...

[hyuga.livejournal.com]

*screams*

Isn't there some higher authority you can go to to complain about this? It has to be a violation of some sort of policy.

I can't imagine what I would feel like if that happened to me--some boss changed *my* password and let some stranger log into my account, and probably didn't change the password back. If I were that person I'd even be looking at legal options on something like that.

[hisamishness.livejournal.com]

That would be a firing offense for me.

[jecook]

And me, even at my last place of work. HIPPA violations are *expensive*...

And here, people will try and give me their passwords, and I cut them off with "I don't need to know that." If they ask for an explanation, I explain to them that I don't *need* their password, as it's trivial for me to reset it...

[network-nerd.livejournal.com]

Change "high-level exec's" password to match, and tell them the guest can use exec's computer instead....

[rorted.livejournal.com]

Nice.

[azurelunatic]

*facepalm*

...I don't even give my best friend in the universe my password. I give him root-level access to my box, but not my password.

[the-s-guy.livejournal.com]

"Excuse me, I have to make a quick phone call to facilitate this. Hello, head of Security?"

[megpie71.livejournal.com]

I'd be putting in a formal complaint about your boss: undercutting your staff like that is *not* *on*. Particularly when it is a breach of some of the most basic rules of computer security. You *don't* change someone else's password without their permission; you *don't* give anyone access to another person's email account, and you certainly *don't* do these things on the request of some upper manglement wonk without at least one *signed* statement accepting the responsibility. Otherwise you let yourself in for so much trouble it's beyond reason.

I'm not sure where you are, but here in .au, what happened would be a breach not only of IT security, but also of the Australian privacy laws.

[255-255-255-0.livejournal.com]

Security ........ or lack of

We have one department that have changed all thier passwords to the SAME password so they can use each others logins.

Another Dept that writes all the users names & passwords on an A4 sheet of paper photocopies it and put a copy on eveyones desk.

Then there are the users with password of PASSWORD written on a post-it stuck on thier monitors.

[crazdgamer.livejournal.com]

And, to follow suit, in another division I support, a laptop which is taken out to the field has only one user account with a password we randomly generated. We then gave the laptop to the division head.

3 months later, laptop comes back for a software install, password written on the damn thing in permanent marker.

Facepalm, indeed.