15

We have a local fileserver on premises. It appears a manager synced his cloud storage account to a folder on this server (in a location that's not very hard to find). This folder is now accessible to anyone in the company and contains an Excel file called 'Salaries', in which the salaries of the employees of a certain department are listed. This is not the first time this manager has done this - on the same server I have found a file which contains feedback and evaluations of employees.

What steps could or should I take? Do nothing and stay safe? Notify HR or Infosec (we have people dedicated to this with GDPR coming up)? Should I do this anonymously? Or maybe I should just straight up inform the manager himself?

  • 11
    If you report it, prepare for questions about why you are snooping through file folders in locations that are "not very hard to find." – Lumberjack Mar 28 '18 at 18:20
  • Does your employer have a written policy about what to do when you see an issue like this? – dwizum Mar 28 '18 at 19:31
  • 1
    @AffableAmbler Questions with ethical components can be on-topic here if they ask practical questions. There's usually significant overlap between ethical and professional in workplace contexts. More on that here. Do note that regardless of the question being on-topic or not, it's considered bad form to (partially) answer it in the comments. – Lilienthal Mar 28 '18 at 19:41
  • Do the same thing you'd do if you accidentally saw your parents in an intimate embrace; pretend you didn't see it and never speak of it again. – Jonathon Cowley-Thom Apr 5 '18 at 15:43
21

Be careful

You are in dangerous territory here. You saw a file called "Salaries" and decided you should open it and see what's inside. If you report this to INFOSEC, your decision to open the file will likely be as big a cause for concern as any careless manager storing files in the wrong folder.

In the future if you discover files that you think may contain sensitive information, don't open them up to dig deeper. You have rightly recognized that you have an obligation to help safeguard the confidentiality of that document, but you compromised that confidentiality when you opened the file.

Next time this happens, instead of opening the file to view the Salaries, examine the security properties of the file and notify the "file owner". If you aren't familiar with how to do this, it will be simpler to report the issue to your IT Department or Help Desk and let them handle things from there.

In this case, I would contact the Manager who saved the file, and let him know that you saw the file name and were concerned about a possible exposure. Let him deal with it from there.

If you see a pattern of careless behavior moving forward, reporting the issue to INFOSEC is your duty, but you need to keep your own nose clean too.

  • 3
    Definitely need to be cautious here. Viewing that information could get one fired. – Mister Positive Mar 28 '18 at 18:57
  • 1
    +1 The days of "If you don't break or take, it's okay" are long over. Excellent, well thought out advice. – Richard Says Reinstate Monica Mar 29 '18 at 16:06
7

It could be a trap

Realize here there is a chance you've been already caught in the Honeypot, and if you don't report this, you may still have to answer tough questions like why you opened the file.

Infosec loves to do things like this, whether dropping a CD in an open area with "Salaries" written on it, or perhaps in this case leaving a document in an easy to find place. The idea around the honeypot is you see something desirable, and then do something you shouldn't (Opening this file). This is a huge weakness for companies, because you can easily be socially engineered to give away your password and cause your company to come under attack.

In your specific case, this may well not be a trap seeing that you saw actual salary information, but you should be forewarned that not everything is as it seems.

  • Why the downvote? Best answer here! – Fattie Mar 29 '18 at 14:30
  • because it's not a trap, given salary information was there. – bharal Mar 31 '18 at 4:31
  • And you know this information is accurate and valid... how? @bharal – user53718 Mar 31 '18 at 5:43
  • well, he asked about it. also he can probably check against his own salary – bharal Mar 31 '18 at 5:44
6

Report to whoever manages permissions on the folders on that server that this folder is readable by anyone and most probably shouldn't be. Do not elaborate. Let them take this from there and remove yourself from this matter.
Unless your firm employs dedicated policies and processes regarding possible internal information leaks (by your description, not very likely), the tech person could just silently fix the permissions and be done with it, especially if it was their fault (even indirectly).

Judging by your description, it's highly unlikely that they will be able to see that you opened the file. As an IT pro, I can attest that file access tracking facilities are a PINA to work with and eat up system resources like nobody's business. So they are not enabled save for in high security environments where it's absolutely necessary. If your environment was that, that manager couldn't have created that folder and set up cloud sync without infosec having scrunitized and authorized it in the first place (and you wouldn't know any of that, either).

Likewise, for the same reason, it's virtually impossible that it's some sort of bait or a mind game by a local Columbo. Especially in the light of the previous similar incidents involving the same person that for all intents and purposes look legitimate.

1

In a previous life I wrote/supported a program that was used to calculate salaries and bonuses for employees. For this I needed to get a feed from HR during salary review season. The file was supposed to have masked/encrypted fields that were unpacked in my program and only viewable by a set of users and their access level.

One year, the program blew up when importing. It turns out the HR clerk that pulled the data that year didn't use the program written (that encrypted the data) but instead ran a Peoplesoft SQR which put the data into plain readable ASCII text. When I opened the file to investigate I could see everyone's current salary.

I immediately notified my supervisor. INFOSEC and HR were notified. My manager notified senior management. Then the CD the data was written to was placed in a secure disposal system by my manager. This had some major ramifications but as we (me and my boss) covered our buts it was others (the HR person) were the ones disciplined.

You can't be too safe here. Notify your boss.

  • 2
    A key difference, here: You were AUTHORIZED to look at that data. The OP was not. – Wesley Long Mar 28 '18 at 20:17
  • Actually I wasn't. That's the reason is was masked. – JazzmanJim Mar 28 '18 at 20:51
  • 2
    I understand you both, and so I feel compelled to build a bridge across the gap of understanding. Please forgive me for butting in my nose, but what @WesleyLong was trying to say is that you were authorized to open the file. Your discovery of the non-encrypted data did not come about as a result of your inappropriate behavior. In the case of OP, his choice to open the file will likely reflect poorly on him, whereas your choice to open the file was expected. – Lumberjack Mar 28 '18 at 21:00
  • @Lumberjack - you're right. I probably should have said that bednarjm was authorized to access the provided file, whereas the OP was not authorized to access the file he discovered. – Wesley Long Mar 28 '18 at 21:04
  • just seems to be an anecdote? – bharal Mar 31 '18 at 4:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.