Ermm...what security?

[meijhen.livejournal.com]

OK, so maybe this isn't horrible and not TRULY stupid, but it's one of those things that makes you go....wtf?

BG: I am second-level support for an e-procurement solution -- users login to the website, click through to the eProc side, and can then happily order services & hardware through their company catalog. They must login to the front end first, and then the tool automatically validates when they go through to EP. However, because many users only use the whole solution to access the EP, they refer to the whole thing as "myEP." NOTE: I only support the EP portion, not the web front-end.

I received a ticket yesterday for a lady who wasn't able to login. Usually this is a web front-end issue, but the helpdesk just hears the words "myEP" and sends to us. Not really their fault, they got no training when this went live.
Severity 4 ticket, and I'm not even sure if I can do anything for her, so I send her a note and ask her exactly where she's receiving the error, blah blah blah.
I get a note back that says she doesn't know when I received this ticket, but this had been resolved "weeks ago," all snotty that this ticket has been open for ages or something. I doublecheck the ticket -- not only did I just receive it, but it had only been opened that day too. Hunh.
So I closed it, with a comment cut and pasted from the user's mail.

Today, get a ticket for the same lady. Only this time, it's a sev 2. And in the description it says, the lady who responded to me didn't realize that someone else (her admin) is actually trying to login as her to do her job for her, and the admin lady needs this resolved ASAP.

Um....WTF? Admitting in the ticket that you are committing a security violation (and these people both work for a HUGE bank in a country that is very hyper about security) is not usually a good way to get something done!

Luckily for me....she did clarify that the problem is with the web front-end and not the EP part...so I shipped it off to the other team, after putting a note in the ticket that I wasn't sure this was acceptable procedure.

Man. I wonder about people sometimes.

Comments

[the-s-guy.livejournal.com]

And of course, pasted it into an email along with a copy of the security regs, and cc:ed it to your manager and her manager?

[coraon.livejournal.com]

seriously, the banks are the most scary people out there when it comes to securty, worse then the casinos in vagas (but not atlantic city or masouri[sp?]those are the worst on the planet) Thoses guys are nuts when it comes to passwords and logins. This person if you squel will be fired and she wont be allowed to work with the banks again

[thalionar.livejournal.com]

people think that security regs couldn't possibly apply to *them* because, they'd *never* do anything *wrong* and their assistant/manager/random person in their department could *never* do anything *wrong.*

Ummm... yeah.

[ravenshrinkery.livejournal.com]

The level of ignorance on security is amazingly surprising even in businesses where it is critical to their survival. I suspect that it happens mostly with people who have been around before computer security was anywhere near the issue that it was today - hires since then have had it drilled into them and those who seemed as though they couldn't grasp the concept were often never hired in the first place. But there are exceptions... we see them every day.