18

We have a local fileserver on premises. It appears a manager synced his cloud storage account to a folder on this server (in a location that's not very hard to find). This folder is now accessible to anyone in the company and contains an Excel file called 'Salaries', in which the salaries of the employees of a certain department are listed. This is not the first time this manager has done this - on the same server I have found a file which contains feedback and evaluations of employees.

What steps could or should I take? Do nothing and stay safe? Notify HR or Infosec (we have people dedicated to this with GDPR coming up)? Should I do this anonymously? Or maybe I should just straight up inform the manager himself?

Improve this question
5
  • 13
    If you report it, prepare for questions about why you are snooping through file folders in locations that are "not very hard to find."
    – Lumberjack
    Mar 28, 2018 at 18:20
  • Does your employer have a written policy about what to do when you see an issue like this?
    – dwizum
    Mar 28, 2018 at 19:31
  • 1
    @AffableAmbler Questions with ethical components can be on-topic here if they ask practical questions. There's usually significant overlap between ethical and professional in workplace contexts. More on that here. Do note that regardless of the question being on-topic or not, it's considered bad form to (partially) answer it in the comments.
    – Lilienthal ♦
    Mar 28, 2018 at 19:41
  • Do the same thing you'd do if you accidentally saw your parents in an intimate embrace; pretend you didn't see it and never speak of it again.
    – Jonathon Cowley-Thom
    Apr 5, 2018 at 15:43
  • @Lumberjack - If files are not meant for to be seen by me, then I shouldn't be able to find them and open them. It's not "snooping" for me to go through and see every file out there that is available to me. That's an easy query to respond to.
    – PoloHoleSet
    Apr 24 at 18:11

4 Answers 4

Reset to default
25

Be careful

You are in dangerous territory here. You saw a file called "Salaries" and decided you should open it and see what's inside. If you report this to INFOSEC, your decision to open the file will likely be as big a cause for concern as any careless manager storing files in the wrong folder.

In the future if you discover files that you think may contain sensitive information, don't open them up to dig deeper. You have rightly recognized that you have an obligation to help safeguard the confidentiality of that document, but you compromised that confidentiality when you opened the file.

Next time this happens, instead of opening the file to view the Salaries, examine the security properties of the file and notify the "file owner". If you aren't familiar with how to do this, it will be simpler to report the issue to your IT Department or Help Desk and let them handle things from there.

In this case, I would contact the Manager who saved the file, and let him know that you saw the file name and were concerned about a possible exposure. Let him deal with it from there.

If you see a pattern of careless behavior moving forward, reporting the issue to INFOSEC is your duty, but you need to keep your own nose clean too.

Improve this answer
13
  • 5
    Definitely need to be cautious here. Viewing that information could get one fired.
    – Neo
    Mar 28, 2018 at 18:57
  • 3
    +1 The days of "If you don't break or take, it's okay" are long over. Excellent, well thought out advice.
    – Old_Lamplighter
    Mar 29, 2018 at 16:06
  • 1
    I have to disagree with this. If I can open a folder, then my assumption is that I'm allowed to have access to and see the contents within. If I can open a file, then it's my assumption that I'm meant to be able to see the contents. If it has confidential information, it shouldn't be safeguarded by having an ominous sounding file name. It's supposed to be locked down. If I see it and I'm not supposed to, that's on the person who created the file, or the IT department that manages security and access.
    – PoloHoleSet
    Apr 24 at 18:15
  • 2
    @PoloHoleSet Your assumption seems questionable. If someone left their filing cabinet or desk unlocked, would you assume that you have the right to see all documents inside it? If someone left their front door unlocked, would you assume that you have the right to wander in and look round? — Yes, confidential information should have better protection than that, but I don't think that's an excuse for looking at it. Ability ≠ right.
    – gidds
    Apr 25 at 21:37
  • 1
    @PoloHoleSet If I left my wallet on my desk, opened, and with some bills loose, are you free to take them? Of course not. That's clearly my wallet, on my desk, and it's my money. Your ease of access is not justification. There's no good reason why a random employee would reason that he should have access to a file called "Salaries".
    – Nelson
    Apr 27 at 3:42
13

Report to whoever manages permissions on the folders on that server that this folder is readable by anyone and most probably shouldn't be. Do not elaborate. Let them take this from there and remove yourself from this matter.
Unless your firm employs dedicated policies and processes regarding possible internal information leaks (by your description, not very likely), the tech person will probably just silently fix the permissions and be done with it, especially if it was their fault (even indirectly).

Judging by your description, it's highly unlikely that they will be able to see that you opened the file. As an IT pro, I can attest that file access tracking facilities are a PINA to work with and eat up system resources like nobody's business. So they are not enabled save for in high security environments where it's absolutely necessary. If your environment was that, that manager couldn't have created that folder and set up cloud sync without infosec having scrunitized and authorized it in the first place (and you wouldn't know any of that, either).

Likewise, for the same reason, it's virtually impossible that it's some sort of bait or a mind game by a local Columbo. Especially in the light of the previous similar incidents involving the same person that for all intents and purposes look legitimate.

Improve this answer
7

It could be a trap

Realize here there is a chance you've been already caught in the Honeypot, and if you don't report this, you may still have to answer tough questions like why you opened the file.

Infosec loves to do things like this, whether dropping a CD in an open area with "Salaries" written on it, or perhaps in this case leaving a document in an easy to find place. The idea around the honeypot is you see something desirable, and then do something you shouldn't (Opening this file). This is a huge weakness for companies, because you can easily be socially engineered to give away your password and cause your company to come under attack.

In your specific case, this may well not be a trap seeing that you saw actual salary information, but you should be forewarned that not everything is as it seems.

Improve this answer
11
  • Why the downvote? Best answer here!
    – Fattie
    Mar 29, 2018 at 14:30
  • because it's not a trap, given salary information was there.
    – bharal
    Mar 31, 2018 at 4:31
  • And you know this information is accurate and valid... how? @bharal
    – user53718
    Mar 31, 2018 at 5:43
  • 3
    I'm sorry, but I'm down-voting. If I can open a file, then that's not something I shouldn't be doing, because if I'm not supposed to, then I shouldn't have access. If I see something, AFTER opening that makes me say "I shouldn't be able to see this," then I report it, but the baseline "can I open this?" answer is - "I don't know, CAN you open it?"
    – PoloHoleSet
    Apr 24 at 18:18
  • 2
    @PoloHoleSet Interesting concept, have you tried this with your neighbors mail?
    – David S
    Apr 24 at 23:01
2

In a previous life I wrote/supported a program that was used to calculate salaries and bonuses for employees. For this I needed to get a feed from HR during salary review season. The file was supposed to have masked/encrypted fields that were unpacked in my program and only viewable by a set of users and their access level.

One year, the program blew up when importing. It turns out the HR clerk that pulled the data that year didn't use the program written (that encrypted the data) but instead ran a Peoplesoft SQR which put the data into plain readable ASCII text. When I opened the file to investigate I could see everyone's current salary.

I immediately notified my supervisor. INFOSEC and HR were notified. My manager notified senior management. Then the CD the data was written to was placed in a secure disposal system by my manager. This had some major ramifications but as we (me and my boss) covered our buts it was others (the HR person) were the ones disciplined.

You can't be too safe here. Notify your boss.

Improve this answer
5
  • 2
    A key difference, here: You were AUTHORIZED to look at that data. The OP was not.
    – Wesley Long
    Mar 28, 2018 at 20:17
  • 1
    Actually I wasn't. That's the reason is was masked.
    – JazzmanJim
    Mar 28, 2018 at 20:51
  • 4
    I understand you both, and so I feel compelled to build a bridge across the gap of understanding. Please forgive me for butting in my nose, but what @WesleyLong was trying to say is that you were authorized to open the file. Your discovery of the non-encrypted data did not come about as a result of your inappropriate behavior. In the case of OP, his choice to open the file will likely reflect poorly on him, whereas your choice to open the file was expected.
    – Lumberjack
    Mar 28, 2018 at 21:00
  • @Lumberjack - you're right. I probably should have said that bednarjm was authorized to access the provided file, whereas the OP was not authorized to access the file he discovered.
    – Wesley Long
    Mar 28, 2018 at 21:04
  • just seems to be an anecdote?
    – bharal
    Mar 31, 2018 at 4:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .