Slashdot Mirror
Don't Network Administrators Require Privacy?
An anonymous reader writes to tell us that Recently their company has decided to move the IT staff out of their offices to make room for the Service Department. The move has placed the IT staff in cubicles that all face inward and lack, obviously, the ability to lock their doors at night. This is, to them, an obvious breach in security and privacy for what may be sensitive network information. Have any other Slashdot readers dealt with this sort of problem before? If so, what specific information was best suited to rectify these security concerns?
Quit trying to make up bogus reasons as to why you don't want to be in a cube and just tell your boss, "I don't want to be in a cube." If it's a dealbreaker for you, resign. Next they'll be moving you down into the basement and taking away your red stapler.
Bullshit. Once you have physical access to the PC you can compromise it.
Draw up a budget proposal for whatever locking file cabinets, secure equipment cabinets, Kensington locks (better than nothing...) and desktop security software that you'll need to ensure the security and functionality of your information systems. Keep in mind that this includes not only malicious snoopers but also cleaning staff that snag cables with their vacuum cleaners, and take whatever precautions are necessary.
Be thorough, but don't make stuff up. Don't make it a turf war, just make it clear that you're working to protect the systems that you're responsible.
Come up with this proposal, and an estimate of the costs, and request that Accounting begin soliciting bids from vendors. And then lightly suggest that this would not be necessary if you could have good locking offices.
Keep in mind, though, that private offices are only effective if they are truly private. If they're not always proerly locked, or if too many people have the keys, then you'll be the worst kind of office hypocrite.
The "secure your computer" idea is obvious enough. There are other subtle problems though.
The "looking over your shoulder" problem is more difficult to deal with than you might think. More than once I've had issues with users stalking up behind me and reading my screen before I even knew they were there. (the really rude ones ask questions about what they've read) I could be doing any number of sensitive things - sending someone an email discussing the layoffs that are scheduled for next week, chatting with someone sending them their new account password, drafting a memo to someone outlining new security policy... posting the new router passwords on a secure filestore... any of these and more could be serious breaches of security and privacy if observed by the wrong people, and as another poster mentioned, could violate state or federal laws.
It's really a design problem to set up a cubicle where the user faces away from their door. For one, they can either look at their visitor OR their computer, but not both. I always prefer looking at my monitor, and then off to its side to see my guest. This also allows me to look up information for them without having to turn my back on them. Intelligent cubicle design has the desk on the left or right of the doorway, not opposite it. If your desk is opposite your cubicle doorway, tell your HR to get a clue. The best cubicle design is of course to have to walk around your desk and sit down, facing the doorway as well as your monitor, but I'll recognize that not every company has the space or the funds for such large cubicles.
As for physical security, that's another matter in itself. The best design is of course to have every computer imaged identically, with network login and home folder, and to allow no one to store their own information on the local hard drive. This seldom goes completely followed, and all sorts of things wind up on the local drives. Besides being a backup risk, anyone with physical access when you are away from your cubicle can rummage through your hard drive. Some I.T. are paranoid even of the nighttime janitors and clean the I.T. room themselves so they don't have to give out another key. But for that I'd say if you don't have janitorial staff you can trust at least that much, you need to find new janitors.
And of course if the fileserver is in your cubicle with you, that opens up a whole new can of worms. (and if not, why is your office away from the server room?) On that note I will say one thing I am against... leaving the server with an account logged in on it. I see that where I work sometimes, and it bothers me. I like that extra layer of security on top of physical security, and knowing someone with a key can play with the server is not my idea of a Good Thing(tm).
I work for the Department of Redundancy Department.
Actually, all that has to be done, is to follow a clean desk policy.
Monitors need to be faced in such a way so that they cannot be viewed from the walkways.
I also run mine at maximum resolution (1400x1150 for the laptop and 1600x1200 for the 20" second display) with small fonts so that my eyes are the only ones that can read anything displayed (unless someone looks directly over my shoulder).
Important papers have to be stored in locking cabinets/file drawers.
No sensitive information should be stored on the workstations. All sensitive information should be stored in a protected data-center type environment. File servers, host systems, database servers should all be protected. Workstations should be set to lock within a few minutes (mine is set for 2 minutes). I also have gotten into the habit of locking my workstation before I stand up for anything.
With no locally stored sensitive information, then the administrators PC is unable to be used as a tool to gain said information.
Cubicles are not necessarily evil, they are however, a fact of corporate life.
Don't be lazy, keep the information secure, rather than trusting a simple "door-lock" to keep unsecured data secure.
Who is general failure, and why is he reading my hard drive?
Nice post.
> But for that I'd say if you don't have janitorial staff you can trust at least that much, you need to find new janitors.
I disagree. I think your colleagues are making a very prudent move by cleaning those rooms themselves. It's not about trust, it's about money. A janitorial position is simply not worth passing up a hefty bribe.
Fun example: My sister went to school in Ghana for a year. Going price for a human to do menial labor is about $5/month (or something like that,) so the school kept four people watching the international dorm 24/7. Going price to get into the international dorm: about $20. After a "break-in" the guards get fired, take a paid month off, find another shitty job. The burgler gets a laptop to fence. Everyone's happy.
Now, if the school had one person on duty 24/7, and that person was making $20/month, then that person might start valueing the job over bribes. Job security in a position paying 4x what you could get anywhere else is worth a lot more than one month's pay.
Even ignoring the difference in salary, an IT person has a lot invested in their career that a janitor does not. So they're going to be intrinsically much harder to bribe. Even if you get a dishonest one.
Yeah, and that's the overpriced ThinkGeek one. I've seen them cheaper than that $10, and even free at trade shows.
I think that most professional geeks need to come to grips with reality. If you're in IT, you probably think you're more important than you really are, while management probably thinks you're less important than you really are. This, obviously, adds up to a huge disparity, and causes plenty of conflict when these two distorted realities butt heads.
I'm sure some will look at this and say "no, really, I'm that important", but really, you're not. First, think about how many other people have exactly as much value as you do to the business. Unless you're in a very, very small shop, there's more than one person doing critical IT things in the first place. Then consider the people who produce whatever it is that your business does. It's popular in geek circles to complain that those people don't understand that they wouldn't be able to do their jobs without us geeks. Well, here's a news flash: you wouldn't have that job to do without them.
Next, try to remove that built-in Dilbert filter you've developed, and take a critical look at your immediate management. Now, your manager may be just as utterly useless as the stereotypes one would normally apply, but more often than not, that's an unfair stereotype. I know for certain that without my team lead or our group's manager, who both know how to work within the corporate political system to get things done, I would have been either downsized because upper management had no idea whether I was of any use, or I would have been fired for pissing off enough people.
You should also consider what those other departments really do (outside of the automatic reaction you probably have to that question, which is almost certainly along the lines of "annoy me" or "piss me off"). Sure, without the network guys, lots of things wouldn't get done; what wouldn't get done without this other department? "Service Department" is sufficiently generic that I have no idea what they do, but contrary to the common jokes about it, businesses aren't usually in the habit of hiring people to do nothing. Or take the Sales department, which is one of the bigger targets of IT vitriol. The individuals may often deserve it, or they may not (I've known some incredibly slimy sales guys in my life), but either way: the business needs customers. Without the IT guys, the sales guys would lack email, IM, and possibly even the productivity tools they use daily, but without the sales guys, nobody would be paying the IT guys' salaries.
For reference, I've only ever worked in one place where the IT staff got offices instead of cubicles, and that's mainly because there weren't any cubicles anywhere in our small office space. Not to mention the fact that it was about a 25-person ISP, and our customer base was primarily in a few counties. Oh, and they've since been gobbled up by a much larger competitor, had their employees laid off, and moved operations to another state.
I think, ultimately, that the submitter (and the GP) need a reality check. Despite what years in IT have led you to believe, you're not the most important preson in the organization and you're never going to be viewed as such. Millions of people get their jobs done just fine within cubicles. And for the GP: if you have a server in your cube or office, you're just asking for it anyway.