Slashdot Mirror
Don't Network Administrators Require Privacy?
An anonymous reader writes to tell us that Recently their company has decided to move the IT staff out of their offices to make room for the Service Department. The move has placed the IT staff in cubicles that all face inward and lack, obviously, the ability to lock their doors at night. This is, to them, an obvious breach in security and privacy for what may be sensitive network information. Have any other Slashdot readers dealt with this sort of problem before? If so, what specific information was best suited to rectify these security concerns?
No, of course not. Just secure your computer and don't let people stand there looking over your shoulder. Get over it.
Quit trying to make up bogus reasons as to why you don't want to be in a cube and just tell your boss, "I don't want to be in a cube." If it's a dealbreaker for you, resign. Next they'll be moving you down into the basement and taking away your red stapler.
If you behave well, i.e. no sensitive information on your workstation (it shouldn't be there), and lock or turn off your workstation, the danger is a large as having any active network port accesible.
Where I work we have the same situation. However all of IT (security, network and so on) is in the same office area. In order to secure the area they just put up a wall and secure card access. That way the only people in there are the IT people. If you can't trust your IT staff, than they don't have any business being your IT staff. That way the risk is still there, but you don't have anyone other than IT in the area to begin with.
Bullshit. Once you have physical access to the PC you can compromise it.
Draw up a budget proposal for whatever locking file cabinets, secure equipment cabinets, Kensington locks (better than nothing...) and desktop security software that you'll need to ensure the security and functionality of your information systems. Keep in mind that this includes not only malicious snoopers but also cleaning staff that snag cables with their vacuum cleaners, and take whatever precautions are necessary.
Be thorough, but don't make stuff up. Don't make it a turf war, just make it clear that you're working to protect the systems that you're responsible.
Come up with this proposal, and an estimate of the costs, and request that Accounting begin soliciting bids from vendors. And then lightly suggest that this would not be necessary if you could have good locking offices.
Keep in mind, though, that private offices are only effective if they are truly private. If they're not always proerly locked, or if too many people have the keys, then you'll be the worst kind of office hypocrite.
We will revolt and without us the worlds infrastructure will collapse!!!
We will revolt until our spouses scream "Go out and get a damned job already you lazy, good for nothing loser!"
This is not a dream, not a dream...we are transmitting from the year 1-9-9-9.
"shit, some exec nicked my office and I was put in a cubicle instead"
Which actualy, I see as a legitimate complaint. An office has a certain kudos, so being forced out does mean an effective (albeit small) demotion. Maybe not a major deal, but certainly something that would justify complaint.
I have a utility on a floppy disk that allows you to reset the admin password on any Windows box. A google search, 1 floppy disk and 10 minutes of physical access to a PC is all someone needs to rape a Windows box.
Death is lighter than a feather, Duty heavier than a mountain.
Actually, all that has to be done, is to follow a clean desk policy.
Monitors need to be faced in such a way so that they cannot be viewed from the walkways.
I also run mine at maximum resolution (1400x1150 for the laptop and 1600x1200 for the 20" second display) with small fonts so that my eyes are the only ones that can read anything displayed (unless someone looks directly over my shoulder).
Important papers have to be stored in locking cabinets/file drawers.
No sensitive information should be stored on the workstations. All sensitive information should be stored in a protected data-center type environment. File servers, host systems, database servers should all be protected. Workstations should be set to lock within a few minutes (mine is set for 2 minutes). I also have gotten into the habit of locking my workstation before I stand up for anything.
With no locally stored sensitive information, then the administrators PC is unable to be used as a tool to gain said information.
Cubicles are not necessarily evil, they are however, a fact of corporate life.
Don't be lazy, keep the information secure, rather than trusting a simple "door-lock" to keep unsecured data secure.
Who is general failure, and why is he reading my hard drive?
I'm a Network Administrator for a very large corporation and I found myself in the very same situation.
I had my own private office, however a request was made by Human Resources for the construction of new offices for their own use. Rather than the $10,000 price tag, I _requested_ that I transfer out to the cubicles on our main floor. Basically, it was a decision I made for the benefit of the company.
I find that no one really _needs_ private offices, unless they participate in confidential conversations. HR, for example. But really, couldn't offices or boardrooms be booked for those type of activities?
Once I was out on the floor, it was very simple to establish security. My main system was placed in a physically secured location (data centre) and I remotely accessed the PC via secure connection.
You have to understand that nothing is really secure. I ran it like a bank - it could be hacked, but I wanted to catch the person afterwords. Everything on the remote PC and local PC was logged and I also trained security cameras (inexpensive purchase for a 2 week DVR) on their locations.
Also, you can install privacy screens on the front of your monitor so that only the person sitting directly in front of it can see the desktop. They also help with glare.
I find it much more enjoyable with the rest of the team now. Having a private office can be rather lonely for managers sometimes.
I'm much more concerned about a network admin that flaunts sensitive information as a rebuttal because he doesn't want to be moved into a cubicle, than I am about network information hidden by a cubicle wall rather than a more classical solid version of a wall. Your "bricks-and-mortar" walls are redundant in a virtual world, and so are the more limited cubicle versions. Simple suggestion: lock or log-off your terminal and turn the screen away from the cubicle opening. Now how tough was that? .... oh, the problem is you're still in a cubicle? Well most of the people around you are too; start a self-help group with the other people if it bothers you. This article isn't about security ... it's about cubicles and a whiner for crying out loud!
Privacy is important to any real network admin / computer support person. Not only do we often has information up on our monitors that would compromise security if it was viewed by others, many of the phone conversations involved in resolving problems also contain information that may be sensitive. Someone close to my desk could pick up IP address, Router information, Type, model and OS version on our firewalls. For instance, we had a video conference with our manager on Friday regarding the implementation of the patches to our Cisco routers and whether it had to be done this weekend. He asked for the router passwords over the phone...his opinion is that EMail is unsafe. Then there is the other type of work we do. For example, I was working on a report last week that basically involved some deep data mining of our health plan over the last five years. The benefits person, a sweet young thing of 55 going on 2000 was asking me how to take the data and apply various scenarios to it - such as increasing the employee contributions, reducing maximum payouts and removing some coverages. Its obvious from our conversation and from the data that cuts are going to be made. This sort of stuff is not something management wants to be public. Wednesday, I had to recover about 100 EMails for our Human Resources person. Some of them included questions about Employee evaluations. Some companies may not ever have their Net Admins talk on the phone or use their monitors to work on but we sure do.
It could be far worse....just be happy they didn't hire someone in New Delhi to administer your servers.
"Weapons should be hardy rather than decorative" - Miyamoto Musashi
I think that goes for OS's too
You are asking about privacy, not about the limited access of specific company-owned information.
You are NOT entitled to privacy in the workplace. You are entitled to limit access to your work materials to those employees that have the need to know.
Two completely different concepts.
You can run IT from a cubicle, there is nothing terrible about that. If you are going to type in a password, look over your shoulder and make sure nobody is watching you. Access to the machine itself is no issue since you are not going to put your servers in your own office, they go to their own room. If you were running all the servers from your office then you are not as smart as you think you are.
Regardless of server OS, you can manage it from anywhere, there is no need to be sitting in front of the damn machine.
As for privacy, when you signed your offer letter and you agreed to follow company guidelines, you pretty much signed away any hope of privacy in the workplace. The boss can listen to your phone calls, can read your mail and read your paperwork. Yes, your boss can read your personal email if you are trying to read it from your workstation at the office. It is the company's computer and you are using the company's resources for personal reasons.
Now, say you are a programmer or a DBA, then you need a bit more shielding from prying eyes. But the plain IT folks? Nah, they can sit outside like everyone else.
Pedro
----
The Insomniac Coder
" With the exception of PHB's X, Y, and Z, anyone found in this cubicle when the employee who uses it is absent will be TERMINATED ."
And that accomplishes nothing. It's just like taking guns away from people who want to own them legally. People who read that sign and abide me it, much like people who properly purchase firearms, are not the ones you need to worry about. Frankly, I don't even know what an "administrative PC" is anyway. My laptop can be an administrative device wherever I take it. This is why you use things like one time passwords and carefully protected SSH keys for security.
"Nature doesn't care how smart you are. You can still be wrong." - Richard Feynman
What are you in, marketing? You ever hear of key loggers ya horse's arse? Do you understand that physical access to a system is practically system ownership, irrespective of what operating system you're running? Give me physical access to your network admin's box and I will own your organisations data.
A network administrator holds the keys to the kingdom in any environment where information is valuable. Meaning, if you're in an environment developing any type of IP which you don't want your competitors knowing about, you better treat your network admin as you would your personal body guard, because that is what he is in that scenario. Industriable espioniage is real. It happens. Having some fracknut in your organization who read 2 copies of 2600 and wants to be a hacker, is real. That happens. Key loggers are trivial to obtain and use. That happens. Booting a system through an alternative means and futzing with the info on the harddrive is real, that happens.
If your organization's information is valuable, then your information security strategy had better include physical security and not just some idiots idea of "oh just log out of the machine and you'll be fine you stupid retard."
Dumbest Slashdot Reply. Ever.
Workstations should be set to lock within a few minutes (mine is set for 2 minutes).
Don't you ever stop to think?
Good heavens, if my screen locked after two minutes of inactivity I wouldn't make it through the day.
If you're a zombie and you know it, bite your friend!
Yes, thats a good start.
Furthermore how is this any different then most other people in the company.
Does the original poster think a engineer sitting in a cubical designing a Death Ray with drawings and such about is in any less of a bad situation.
Honestly IT people would be one of the first people to get cubed in most places. They are much less likely to be seeing important stuff, or having important/need to know phone calls and so forth.
You can do it to the CEO, you can do it to the CIO or everyone else, but... ... never EVER mess with the master of all beancounters !
Cubicles are not necessarily evil, they are however, a fact of corporate life.
Cubicles present no significant cost gain over giving everyone a small office with a door. That material they use to make cubes is expensive. In fact, this has been done on Slashdot before and many link were posted to different office design styles. The general consensus was that technical types (IT, engineers, etc) like to be able to isolate themselves from the world for periods of time so they can focus entirely on a task.
Cubes don't give you that. I am continually distracted by the goings-on in the next cube. If two or three people are there looking at a demonstration or trying to find a bug then it's very noisy and I find myself having to wind up the volume on my closed-back headphones to unsafe levels.
Should I remind anyone what happens when people in your office are testing audio equipment or a product that talks over a 56k modem in an open plan environment? All I hear all day is that noisy screech of modems (we have hundreds of them scattered around the place) and "test, 1, 2, test" through the other audio equipment that people are testing.
It has been studied to death and decided that if you put technical people in an office with a door they will be more productive. I think this more than offsets all the other reasons for having cubes, and the exotic measures that you have to go through to protect people's privacy when they are in cubes (lockable drawers, filing cabinets, secured rooms for storage of documents, etc).
Cubes are put in place by management who want some level of separation between the "elite" and the rest of us. Management justify it by saying "we want to foster an interractive and friendly work environment to encourage productivity" but they have never had to work in cubes, and dont understand the loss of productivity that will occur when everyone is there.
I drink to make other people interesting!
And locking documents in your drawers?
A lot of admin types are in the 'sea of cubes' and get by just fine with security.
If you think a office door will secure you, give me 15 seconds with a rake and tension wrench. ( if you have to ask, go look it up )
---- Booth was a patriot ----
I have told the big-wigs, in meetings now, that we will be losing our physical security.
You could always estimate how much it would cost to compensate for the lack of physical security. Make it cost twice as much as keeping the room. If they still balk, advise them in writing of the consequences and demand a signature. Keep this offsite.
"We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
The best argument I've heard for real offices is that they should be allocated to people who need privacy OR quiet to do their work. With all due respect to secretaries, the last thing you need is a secretary playing some music that drives you insane when you're trying to work out the deep implications of some program code or security issue.
Oh, and the corollary I meant to include in that is that offices should not be allocated for the purposes of prestige. If highly paid employees get an office for the sake of their vanity, when they're actually not even in the building much, and when they are, they're talking to people in plain sight, while IT guys who need to think are dealing with cleaners vacuuming around them, then I think that says something about the kind of company you're working for.
In terms of the productivity argument, that holds a little more water. It still depends on the maturity level of the person in question, though. Give some hot-shot kid with zero professional experience an office with a door, and watch his productivity soar. Provided you count the number of slashdot posts, and hours spent on Myspace as productivity. In the case of a mature person, an office would probably increase their level of productivity. But if they are that mature, they probably have the ability to sack up, and get their job done in the face of such arduous conditions as being forced to sit in a cubicle.
Someone mentioned that the cost of cubicles is actually not much (or at all) less than that of giving people their own office. I find that pretty suspect, but we'll assume that to be true for the moment. Can someone clear up how this doesn't simply take up more floor space that may not even be available? Is floor space being taken into account in the cost analysis? I would think that if you have to construct a whole new building for every 30 people you hire, you're probably going to save a couple of bucks in just building up a cube city.
I agree that there is probably a degree of management elitism in most cases, that keeps the peons in their cubes, and the Directors in their offices, but oh well. Suck it up, and get your job done, or go find a new one. Apparently you weren't so distracted by your co-workers that you couldn't post an inane story on Slashdot.
This is my sig. There are many like it, but this one is mine...
Cough! Bull-shit! Cough!
Are you going to tear apart a laptop that isn't there?
Are you going to bunk with bios settings that are locked via password, with a chassis that is locked so that you cannot open the case?
No, the systems are not configured to boot from CD-ROM, who the fuck do you think you're dealing with, your ignorant mother?
Did you know that most corporate networks have workstations that have USB DISABLED? so external drives never work... Obviously, you didn't.
So, the only way you're going to get the data, is if you physically STEAL the computer.
Pull your head out of your ass, and go work for Radio Shack, where you can pretend you know something.
Old hard drives are not thrown out - they are sent through an industrial chipper / shredder then sent to be melted down for scrap. And why, oh why would you *WHIP* your old hard drives. (i'll assume you meant wipe, but hell, I don't know)
Now, I don't know how much you spent on your *EDUKASHUN* (intentionally mis-spelled, so that you would UNDUHSTAND me), but you overpaid.
Who is general failure, and why is he reading my hard drive?
I totally agree with the private-office = more productivity thing in as far as that productivity refers to an individual working alone for periods of time.
I don't agree that offices are roughly the same cost to install as cubes. As others have said here, cubes are easier to light, ventilate and electrify. I think you also may use less space per person with cubes than offices.
But most importantly, remember with software developers you need to encourage a certain degree of chatter/communication as part of team productivity. With fewer barriers to communication between developers on a team (ie fewer walls and doors), you increase knowledge sharing, juniors learning from seniors, coordination.
If you have a decent team of people working together and isolated enough from the rest of the world, you can evolve amongst yourselves have to handle music and other noises. eg, come up with a "silence token" of some sort (like a stuffed bill gates doll) that you put on your monitor when people shuld be quiet. Or wearing headphones is a universal symbol of "quiet, please".
Also cubes allow people to work in broader more open spaces. eg, if you have a space with 15-20 foot ceilings and sunlight coming in properly, it can be a plus to take advantage of that over being in a box with an 8ft ceiling which may or may not have a window.
Of course it's a balance. I think management in our industry has been trying to find the sweet spot here forever.