Slashdot Mirror
10% of IT Pros Can Access Previous Jobs' Accounts
dinscott writes "According to a survey that examines how IT professionals and employees view the use of policies and technologies to manage and protect users' electronic identities, the sharing of work log-ins and passwords between co-workers is a regular occurrence. It's no wonder then that half of them are concerned about insider threats to network security in their company's current infrastructure! But one of the most surprising results shows that one in 10 IT professionals admit they have accounts from previous jobs, from which they can still access systems even though they've left the organization."
People often leave on good terms and the accounts are kept so the ex-employees can help out later here and there if asked.
Go green: turn off your refrigerator.
They made you disable the access?! That's either very lazy or...well, I don't know what else. Relying on the person leaving to kill their own access is a bit like leaving the wolf to tend the chickens, no? I'm sure there are audit trails that show that if certain places in the network are accessed it can be traced back to your username, but who's to say that your particular account didn't get hacked? This only creates headaches for the IT manager later down the road. This reminds me of my brother who is very good at not working, but at a cost where he actually works harder to not work, more so than he would if he actually just fucking worked.
Loading...
I'm with you right up til you start talking about mandatory password changes. Research has pretty well proved by now that making people change their passwords regularly means they write them down. A written down password provides a worthless level of protection from from almost every attempt to get into a system. Statistically a person with a secure password they can remember is far more secure then any number of new passwords they cannot.
we are all invisible unless we choose otherwise
> but is it my responsibility to suggest they change the password?
You should do so for your own protection. Do it in writing. Don't check to see if the password has been changed, however: you could be accused of "breaking in". Just send them a letter reminding them to make the change.
> especially since a 'professional' it outsourcing company took it over?
Which may look around for a scapegoat after they screw up. You really don't want them to discover that a break-in occured via an account for which you, a "disgruntled former employee", had a password.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
I hate when people don't actually tell me that an employee has left. Last week someone was like "did you know that Elaine is back already?" and I was suprised to hear that she'd even left. Sure, come to me when you need a new account, but if someone leaves nobody says a thing. In fact I'm going to email our new HR dept right now, it should be part of the procedure when people leave..
which is totally what she said
When I leave a place, or a contract is over, I usually work it into an email to request my credentials be removed, or account disabled. When something goes wrong, the first thing everyone does is point a finger at the last person that left. If my account has been disabled, it's pretty easy for me to prove my innocence and not waste time trying to convince anyone. Also puts a little more weight into your argument when you produce an account revocation document which a company was negligent in following through with. Doesn't sound like much, but makes a *huge* difference when the witch hunt starts.
boycott slashdot February 10th - 17th check out: altSlashdot.org
People often leave on good terms and the accounts are kept so the ex-employees can help out later here and there if asked.
At my current job, I've replaced a guy who accomplished a hell of a lot in the two years that he was here. There's a good chunk of stuff here that my boss doesn't really feel comfortable with. So he disabled my predecessor's account, instead of straight-up deleting it, in case we had to call him in for help (at which point he would have been paid as an independent contractor).
But that account is disabled. Even though it's still got the same credentials on it, and could be re-activated and used in an emergency, it doesn't currently work. My predecessor could not log in right now if he wanted to.
You'd have to be crazy to intentionally leave an account active and functioning after someone leaves the company.
"Work is the curse of the drinking classes." -Oscar Wilde
If only the company who commissioned this survey happened to sell a bunch of account and identity management tools.... Oh, they do? What luck!
I know I still got access because they called me from a previous job if I could help them out and I just tried my login during the call to see what was going on and it was still there. I just thought "oh", fixed the issue and mailed that I still had access and left it at that.
I am a pro but not a sys admin. If I do not work for them, I do not have a need to access their servers and so I don't. Not very hard. Disgruntled? Even then I wouldn't because it would be against the law and could seriously hurt future employment.
The trick therefor for companies is to both have good account management AND hire professionals who care about not becoming a criminal.
Seriously kid, to anyone who read this, you just gave a massive reason NOT to hire you.
Do I as an employer constantly have to worry if it is that time of month for you?
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.