100

I'm one of the many network operators at a corporation. One of the board members asks every time — when in her opinion changes are too slow — for admin access (credentials) so she can do it herself.

I denied it every time, promised a fix within 24 hours, and then delivered. But this person keeps being stubborn and I'm done with this person's behaviour. How can I politely answer that this person won't get any access?

Also this person often uses MAC-address spoofing in combination with the UTP-socket of her work computer to get internet access on her notebook. I told her many times she should use the Wi-Fi but she complains about the quality and range.

Even worse, she is considering to overrule the network administrators by changing the rules so she would automatically be a member and therefore get admin credentials.

What can I do?

Added context from comments:

The company is rather small. It has several board members (highest rank that is daily at the company) and she is our main supervisor.

"Changes" means thinks like installing applications. Removing blockades of the C-disk and so on.

I've got ethernet cables for work pc's and two types of Wifi: Guest and Corporate. Corporate-wifi is for work notebooks that need to authenticate with DC. We only have MAC-adress whitelisting. If you've got the correct address, then you'll get access.

| improve this question | |
  • 2
    have you tried forwarding her demands to someone higher up the chain of command? (assuming it's in email form and can be forwarded) – user1306322 May 22 '18 at 19:26
  • 10
    I'm not sure you are using the term board-member in the fashion I am used to it being used. As I understand it a board-member normally represents the share-holders of the company. The company executives report to the board, but beyond that they don't normally interact with the company's staff. – Lyndon White May 23 '18 at 11:29
  • Based on your added comments, is she in a position to assume the risk and responsibility for violating what is otherwise IT procedures? It sounds like she's in a position to be the one writing the rules. – Cort Ammon May 24 '18 at 19:49
189

What can I do?

First, refer this person back to your security policy and procedures documentation. These topics should be covered clearly, and you can fall back on the documentation to support your position. If this document doesn't exist, consider writing it, and getting it approved by the appropriate people.

Also, I would ask your manager for assistance here. If they say "Give them what they want", at least you have covered your bases. I would make sure you have confirmation from your manager of any requests via email and noted in your ticketing system and change control process.

I would also document, document, document every request of this person's that is outside the normal best practices/against policy. This way if your asked for additional information on this person behavior, you have it.

Board members typically have a great deal of influence. Supervisors can carry weight too. Tread carefully here.

| improve this answer | |
  • 122
    Excellent answer. The goal of this approach is to make it about her vs The Rules instead of her vs MKZ. The OP needs to remove himself from the equation. – dwizum May 22 '18 at 12:42
  • 18
    Make sure the manage is asked (and confirms) in writing instead of verbally! – Doctor Jones May 22 '18 at 15:42
  • 4
    Doesn't the first part just boil down to frustrating the board member with bureaucratic behavior? If I was the board member, if the documentation contains extensive rationale, I'd be receptive to it (though I find many people are less receptive to being redirected to written rationale and want the same information delivered conversationally), but if it's just rules without deep justification and the person blocking me was just obstinately pointing me at the rules without exhibiting a willingness to critically discuss the merits of the rules, that would count against the person in my eyes. – mtraceur May 22 '18 at 19:14
  • 6
    If its in email, I think that is sufficient. "Dear boss, this person wants X which we are normally not allowed to do, Since they are a board member do you want me to make an exception? The email reply of YES is a great record and easy to forward to interested parties. @NicHartley – Neo♦ May 22 '18 at 21:17
  • 10
    ... and if the board wants to put in the security policy the phrase "unless any single member of the board acting alone says otherwise, in which case give them all the keys" then, OK, that's their considered opinion and unless the owners/regulators of the company say otherwise it's the board's right to make that the policy. – Steve Jessop May 23 '18 at 14:27
108

Find a way for helping her while maintaining secure systems.

The board member wants an efficient way to work. Unlike other people, she has the confidence to push back when told that the security rules prevent her for working in a way which is efficient for her. Telling her she must follow the rules doesn't help her. It also doesn’t help all the other people who probably don't even feel they can ask for the same thing. Letting you manager acquiesce to her instead of you doesn't help maintain security, or her image of you.

Give her an alternatives to what she asks for. If improved Wi-Fi access solve her needs then do that. If you haven't budget or time to do that then she can be an ally. Explain to her how you could help if she can her find you the resources you need. If Wi-Fi isn't the answer, how else can you help? Perhaps there are systems you can put in place to make bring-your-own-device possible.

Help her and make the work place better for everyone. If you don't care about helping her then consider this. You say she is being stubborn. She will say the same thing about you. Who's opinion counts? Find a way to make her think you are a great asset to the company.

| improve this answer | |
  • It is more likley this person is trying to access things without a trace. You should report it to the CEO – Bill Leeper May 22 '18 at 20:53
  • 2
    @BillLeeper How does spoofing your own work computer's MAC address allow you to access something without a trace? – reirab May 22 '18 at 22:13
  • 11
    Exactly. It sounds like the board member has sufficient problems with the Wi-Fi that she's going to pretty great lengths to evade access control restrictions. What steps have you taken to address her problem (within the bounds of accepetable policy and security constraints) other than repeatedly telling her to do what apparently isn't working? – Zach Lipton May 23 '18 at 6:01
  • 15
    Please, spend $500 and provide your board member with the necessary environment to work productively. No sane manager will decline the cost, and you end up looking like a "can do" instead of a "won't because". – Konerak May 23 '18 at 6:39
  • 5
    Wi fi coverage - surely just install a flipping booster, in her office or right outside if necessary? Best answer here is one which combines this and the top-voted CYA answer. You have two issues masquerading as one here - A) She wants admin access so she can do things "More Efficiently"(AKA without asking!) B) she wants better wifi access to her notebook. B is an easy fix, particularly for a board member. A'd be polite but hard no in my book, with a referral to our procedures, security documentation and senior management. Also, up your sla's to the board! 24hrs, really? – Miller86 May 23 '18 at 13:55
11

Tell her she can have what she wants - but she has to go through proper channels. You don't have the authority to let someone have elevated privileges like that - and she should be glad you don't. There's 8 (or whatever) other members on the board. Would she want all of them running amok in her company's network?

If you get a request from your boss to give her elevated permissions, you'd be happy to do it.

Generally speaking board members don't interact with regular drones, and they don't have any direct power over you. She owns a slice of the company, but only a slice. It isn't hers. The only people she can actually boss around are the C-suite, and even then, not that much. She has to go bother the CTO, and get him to tell your boss to tell you to do that thing for her.

If she can't get the CTO to do that, it's because the CTO thinks its a dumb idea, and you could get in real trouble for doing it. She probably knows that the CTO wouldn't let her do it, which is why she's trying to throw her weight around with the peasants. The board member can't actually fire you, they can just complain about you to the C suite.

But while she's with you, be sympathetic. Tell her that you'd love to do that thing for her. This way you tell her no, cover your behind and maybe get a friend on the board.

| improve this answer | |
9

I'm one of the many network operators at a corporation. One of the board members asks every time, when in her opinion changes are too slow, admin access (credentials) so she can do it herself.

What are the changes, exactly? And why is the board member aware of "the changes"? Are you reporting to the board member?

I denied it every time and I promised I will fix this within 24hrs. And I did.

24 hours is a long time if you want something done yesterday. I'm still not sure why a board member cares about network changes, or even knows about them - can you add more detail?

But this person keeps being stubborn and I'm done with this person's behaviour. How can I politely answer that this person won't get any access?

Hm. This person owns the company, and the C-Suite report to her. In fact, she can vote to fire the C-Suite should she wish. I'm not sure you can be "done" with their behaviour. If the CEO asked this, would you also be similarly "done"?

Also this person often uses MAC-adress spoofing in combination with the UTP-socket of her work computer to get internet access on her notebook. I told her many time she should use the Wi-Fi but she complains about the quality and range.

I don't know what any of that means. Have you attempted to improve the quality of the wifi or come to her with the costs of doing so and what the increase in strength/range would be?

Even worse, she is considering to overrule the network administrators by changing the rules so she would automatically be member and therefore get admin credentials.

Well, if she can do that then she can do that. She owns part of the company, and can vote on new company initiatives. Also, given how competent she appears to be, why is this "even worse"? Has she caused problems in the past?

What can I do?

You can check why your team are reporting to the board, and also why your team are taking a long time to carry out tasks that have such high visibility to the board. Normally these are high priority tasks, but I'm getting the feeling you're putting tasks in a queue and carrying them out, which is silly because it should be priority and not timeliness that determines order.

You can also check the costs to increase the quality of the wifi, and report to this person what those would be.

You can also check why you don't want a highly accomplished person making network changes.

You should finally check your technical credentials at the door. The board run the company, they own stock in the company, and they are typically highly accomplished people - from the sounds of it this person certainly is.

I'm not saying "technical things don't matter", I'm just saying that "technical things don't matter the most", and that actually people's opinions do. Because, in the end, isn't everything just an opinion?

That last sentence is probably a little too philosophical for this site. But certainly be aware that technical issues aren't always the most important.

| improve this answer | |
  • Comments are not for extended discussion; this conversation about security concerns has been moved to chat. – Monica Cellio May 24 '18 at 17:47
  • 2
    Followup questions for the asker to clarify their question should be left as a comment on the question itself, rather than as part of your answer. (Usually you'd ask those questions before answering, but you can always ask them later and then edit your answer accordingly once the asker has clarified.) – V2Blast May 24 '18 at 20:18
  • "Also this person often uses MAC-adress spoofing in combination with the UTP-socket of her work computer to get internet access on her notebook." It means they want to use their personal device on an access controlled wired network, so they are essentially cloning the hardware address (which controls the authentication to the wired network) of their work machine so that their personal device can also access the network. – Davidw May 25 '18 at 5:45
5

For what you should do as per your question asked, I think it's well covered by @gwp's answer - make yourself an asset.

I'm adding my two cents because I believe this perspective may be beneficial for you, since you have a triple bad situation. And IMO it's not the question you are asking that's most important.

  1. You have a board member with technical expertise who believes you should be doing changes much faster than you're doing. That's bad.
  2. She even believes SHE would be able to do it faster. That's double bad.
  3. Triple bad is, she's out to prove it.

While you look at the rules and security (good thing!), she's looking at efficiency.

The only time I ever asked for a root access to another department's things was when I thought they cheat or lie or are very incompetent. In other words: when I was out to do their job better and/or expose them while at it. When I needed the job done and I couldn't have it via proper channels.

She thinks you're inefficient and she could do your job better. I'd consider WHY she thinks so, because addressing that has highest chance to stop her behaviour. You are commendable in your 24h fixes, but if she's not satisfied, then perhaps she's after "not having to do this every single time"? Because apparently, her showing interest in this manner "gets the job done, though in 24 hours".

Perhaps she wants to prove you guys are doing something that you should be doing in another manner? Just my two cents - I'm no board director, but I frequently was doing a special ops'/firefighter's job across many departments.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .