Slashdot Mirror


88% of IT Admins Would Steal Passwords If Laid Off

narramissic writes "According to identity management firm Cyber-Ark's annual 'Trust, Security & Passwords' survey, a whopping 88% of IT administrators would steal CEO passwords, customer database, research and development plans, financial reports, M&A plans and the company's list of privileged passwords if they were suddenly laid off. The survey also found that one third of IT staff admitted to snooping around the network, looking at highly confidential information, such as salary details and people's personal emails."

19 of 448 comments (clear)

  1. Reminds me of the old joke... by Anonymous Coward · · Score: 5, Funny

    99% of men masturbate. The other 1% are lying.

  2. Not reasonable by linear+a · · Score: 5, Interesting

    Sounds like an unreasonable estimate to me. If people were that vindicative and dishonest then IT (and similar) systems wouldn't ever keep working.

    1. Re:Not reasonable by MightyMartian · · Score: 5, Insightful

      A company hawking privacy management claims your IT department is filled with thieves and extortionists. Shocking, I tell you, shocking!!!!

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
    2. Re:Not reasonable by Lobster+Quadrille · · Score: 5, Informative

      It's off topic, but please tell me more about your IT infrastructure. I promise to to do anything bad with it.

      I am constantly amazed at how willing people are to tell you how to attack their own systems, particularly on Slashdot, where simply implying somebody is doing poorly will practically get you full description, network maps, and vulnerability reports.

      Similarly, I was talking to a friend in the Army the other day about IT security, and he told me that he didn't think I could attack his unit's systems, then went into a long discussion about what protections are in place. Out of curiosity, I decided to find out what I could learn. He only clammed up when I started probing for specifics about password policies on a particular device.

      People: please don't tell anybody about your IT configuration. At least not on a public forum like /. Admittedly, a lot of it is easy to find out other ways, but that's no reason to give that information out.

      --
      "The cup is in turn designed for holding hot or cold liquids, and has an open rim and closed base." --US Patent #5425497
    3. Re:Not reasonable by Lobster+Quadrille · · Score: 5, Insightful

      Yes, it's security through obscurity, and I'm as big a fan of Schneier as anybody, but that is still no reason to give out information.

      It's no secret that with enough knowledge of the system, any system can be hacked. That alone is reason to not make knowledge of the system public information.

      To some extent, security through obscurity is absolutely necessary.

      --
      "The cup is in turn designed for holding hot or cold liquids, and has an open rim and closed base." --US Patent #5425497
    4. Re:Not reasonable by Anonymous Coward · · Score: 5, Funny

      I once got what I assumed to be an attempt at social engineering into our systems.

      Caller (who did not identify himself): "Hi, would you be interested in completing a survey?"

      Me (bored): "Uh, alright."

      Him: "Can you outline for me the steps you take to ensure the security of your IT systems?"

      Me: "Absolutely! First, I do not discuss my security configurations with unknown people. Have a nice day." and then hung up on him.

    5. Re:Not reasonable by torkus · · Score: 5, Insightful

      To some extent, security through obscurity is absolutely necessary.

      Not if your systems are properly secured. Unless you consider obscurity keeping your actual password(s) secret :)

      Seriously though: most systems have some vulnerabilities and explaining the details will occasionally open the door for someone who knows more than you do. Yes, it's good to keep this information private. BUT, when designing a security system you need to work based on the assumption that an attacker knows the entire layout. Knows exactly what hardware, software, version, firmware, etc. you have exactly. Anything less is NOT a properly secured system.

      If a network is properly secured the person/group/department who designed it should not be able to gain unauthorized access

      --
      You can get rich if you own a politician, but you have to be rich to buy one in the first place.
    6. Re:Not reasonable by Paaskonijn · · Score: 5, Funny

      They mostly come at night... mostly.

  3. And Cyber Ark are selling? by Colin+Smith · · Score: 5, Insightful

    Let me guess...

     

    --
    Deleted
  4. Figures Seem Inflated by dthrall · · Score: 5, Insightful

    I'm actually surprised at this claim. It would be nice if they posted some additional info, like their sample size, etc. Sorry, I just seriously can't believe that 9 out of 10 people would maliciously act in this manner. Snooping over the network out of curiosity, I'll buy that one.

  5. But... by lucky130 · · Score: 5, Insightful

    How many of them are just saying that to sound cool?

  6. Strong morals? by FliesLikeABrick · · Score: 5, Funny

    What ever happened to sysadmins being known for having strong/good morals and ethics?

  7. Survey is Pants by Fox_1 · · Score: 5, Insightful
    nothing to see here:

    "According to identity management firm Cyber-Ark's annual 'Trust, Security & Passwords'"

    Making the IT folk out to be bogeymen is great business for security pros. I'm sure there are some idiots out there, but most IT people are normal honest people like anybody in any other profession. I don't buy that we are so far off the curve, 81% is bullcrap and makes me question everything about that company and it's motivations and methods for the survey.

    --
    The rock, the vulture, and the chain
  8. Nothing to see here by Arc+the+Daft · · Score: 5, Insightful

    A firm selling data security products claims that people with access to sensitive information can't be trusted. News at 10.

  9. Re:a survey by BobMcD · · Score: 5, Insightful

    ...but something tells me when the time came to break the law they would let the opportunity slide.

    And they'd be wise to do so. Anyone who thinks that stealing such things once laid off is a bright idea just does not have a criminal mind.

    Think it through, fellas - what, exactly, do you plan to DO with this data?

    Do you intend on working in your field, ever again?

    How do you feel about seeing the inside of a federal prison??

    Seriously, lay off the power trip. It's just a fucking job. Don't screw up your ENTIRE life just because you have the password...

  10. Betray the betrayer? by knarfling · · Score: 5, Interesting

    When someone is laid of for no apparent reason, they often feel hurt and betrayed. A natural reaction is that the trust between them has already been destroyed.

    At one company I was with, a sysadmin was on a conference call, and had his hands full when the call ended. The CEO never hung up the phone, and started talking to his assistant about people loosing their jobs and how much severance would be paid. The sysadmin, who probably should have hung up when he was first able to, couldn't resist listening for a short time. After a couple of minutes, the CEO finally realized that his phone was still on, and hung up the line. By that time, the sysadmin knew that several people would be laid off soon, but not how soon, or which people.

    He informed a couple of his friends that the company was in worse shape than he had realized, and discretely began updating his resume. Within a month, the company was bought out and closed down by another company and everyone lost their jobs. He was asked to stay on as part of the transition team and that the new company would pay him, but after a couple of days, it was clear that he had been working for free and the new company was not going to honor the agreement.

    At that time, he still had sysadmin access, and began to look through emails of the former employees. Some, including the CEO, were still getting and sending emails through web access through the old company server. He learned that although the board of directors did not want to spend the money to make sure that the fired employees could still have health insurance for a couple of months, they were willing to give the former CEO $25,000 for his efforts.

    I have always said that a good sysadmin knows all the secrets of a company, but a great sysadmin knows when not to look. In this case, was the sysadmin justified in looking after he had been promised to be paid and then told he was not being paid? (Yes, his access should have been cut off, but he was the one who would have had to cut himself off and he was never told to do so.)

    Although this situation may be unique, I think that many sysadmins may feel the same way. Once they are betrayed, they no longer feel the need to stay loyal to those that betray them.

    --
    Great civilizations have lived and died on false theories. Don't mess up mine with a few facts.
  11. BOFH by Archangel+Michael · · Score: 5, Funny

    You've never seen my personal IT Bible, the Archives of the BOFH.

    He exemplifies keeping a system running smooth THROUGH vindictive and dishonest means.

    He's my Hero.

    --
    Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
  12. Re:Might Be Reasonable by visualight · · Score: 5, Interesting

    I've been through a couple of layoffs. In one, the company was concerned about stealing, sabotage, and other vindictive behaviours. So they surprised everyone with two week severance packages and an escort out the door one morning. They brought in people at the butt crack of dawn to turn off every computer in the building. Later, "core" people started deserting the company, taking whatever they wanted with them.

    In the other one, there was an announcement, something like, "The 20 people in this room are being laid off. Starting in two weeks we're going to lay off 4 people per week for 5 weeks. We expect you all to continue to do your jobs as well as you can *while* you look for work. Let your supervisor know of any scheduled interviews, they will be considered paid time off. As you find work report your start date so each week we can try to lay off people who already have new jobs."

    The second layoff went without a hitch. The people laid off kept relations with the company, some came back later.

    I know it's not the same as firing someone, but it does seem to me some companies treat laid off employees as if they've been fired.

    --
    Samsung took back my unlocked bootloader because Google wants me to rent movies. They're both evil.
  13. Best Revenge Ever... by IBitOBear · · Score: 5, Insightful

    ... Is being missed.

    I was vindictively fired by a total idiot. I made sure that everyone I knew at the company knew the hows and whys of my dispute (including where I _was_ at fault). I also always start grooming my replacement the first day I take a job or can identify the best guy to replace me, because who wants to be stuck in the same job forever.

    In the days following my firing I took several opportunities to talk the guy who replaced me (my friend Dan) how to lock me out of various machines and such.

    For almost eighteen months people at that job were forced to say "is a good thing (my name) made sure we had extra capacity laid in while the trench down the block was opened", or thing-x was purchased, or policy-y was in place.

    By the end of that eighteen months, the guy who had fired me had been shown to be the kind of person who he was, and he was invited to leave the company. (I was long gone and made no attempt to return.)

    If you have to "do something" to your company to make them feel the pain of your absence when you are gone, you weren't previously doing your job.

    Competence, and never looking back except to laugh, is the best revenge ever.

    --
    Innocent people shouldn't be forced to pay for inferior software development.
    --"Code Complete" Microsoft Press