Peer co-worker "out-performing" me due to access rights left over from previous role

Question

My co-worker 'Jan' and I have both worked for the company for a couple of years in our respective roles, but in totally separate teams/functions until now.

We have now (a few months ago) been brought together into a newly formed team with the same role as each other. There are a few other people in this 'new team' as well with various other roles.

Our new role involves some tasks which require setting up and configuring certain systems, which (nerd alert) need as a pre-requisite new accounts to be set up in Active Directory by a Domain Admin. (Essentially a task that requires a very high level of administrative permissions.) Once that account is set up we can "do our stuff". (edited to add: there are various other, similar tasks that need admin-type pre-requisites other than just "New accounts")

However Jan's previous role in the company (unrelated to this one) meant that they had the level of access (e.g. domain admin) to set up that account. For whatever reason, the access wasn't revoked when Jan joined this team. (although it's not really needed any more so it should have been revoked)

As a result Jan can complete the whole request to setup/configure a system, including creating the required account, without requesting it from IT (because Jan already has access from the previous role). In contrast I have to make a request to IT to create that account... wait for it to be set up, then do my thing.

And as a result of that, most of those requests come to Jan rather than me (although we supposedly have the same role) as they can be completed faster because Jan doesn't have to wait for third parties (IT) to set up new accounts etc.

Now I feel like I'm "under-contributing" compared to Jan, especially as this is a new role for both of us and we have appraisals and things like that.

I have spoken to our boss and expressed concern that of course Jan can complete these faster because he "happens to" have that access already, but it shouldn't actually be that way as people should only have access that is 'necessary' based on their job, it's just a mistake that Jan still has this access as it was gained from a previous, completely unrelated role. Boss said something like "but it's so convenient to do it like this as now we don't have to go outside our team to carry out these requests so let's not raise it".

I would like to know how to present it to our boss that Jan's access should be revoked (even if it does make requests take longer and is less convenient) and how to address the fact that people always go to Jan rather than myself because Jan already has (now illegitimate imo) access.

Additional info: Europe (EU) country, we don't do "financial reporting" it's just a private company, it's about 500 people added to by some acquisitions (where my colleague came from) a few years ago.

Answer 1

The first question you need to ask yourself is if there is a real threat here. Is this being driven by a legal obligation or significant security threat, or is it just the sort of official company policy that's only half-enforced and that no one actually cares about? If you've been party to this and it gets found out six months down the line, is anyone out there going to have real reason to be upset at any of you? If there is a compelling reason like that to cut off access, then that's your argument right there (and possibly an official person who you really should be reporting to). If there isn't, though...

Well, in that case, your primary concern seems to be about not wanting to look bad. If you successfully report your coworker and get his access revoked, that's going to significantly upset both your boss and your coworker. I guarantee, that's going to make you look bad. Instead, I'd suggest you work around it. Treat it like any other advantage. Your coworker happens to be really good at this one thing (because he has access). Let him do that thing. Let him do your share. Ask your boss to assign you some other task, where you aren't competing directly with his unfair advantage. I suspect that your boss will appreciate aligning his personnel for greater efficiency - that makes him look good. If for whatever reason he doesn't... then why are you contacting IT? Just ask your buddy the next cubicle over to do it for you. It's highly likely that he can (and will) do it a lot faster than IT will, and if he's not willing to help you out, I suspect that that is something you could get your boss's support on.

Answer 2

I am personally a very competitive person, for better or worse. I would have to do something in this situation. First go directly to yours and Jans boss and ask for a similar user account citing it will make you more productive. If your boss says no we can't do that you don't have those permissions, you mention that Jan has access or ask how you get the same access Jan did. Your boss will either solve the problem by getting you an account or ridding of Jans.

Answer 3

First as an practicing information security professional with ~ 5 years of experience, I commend your attitude of following security best practices, specifically least privileged access. You are right that people should only have the necessary access rights needed to perform their job duties.

I would like to know how to present it to our boss that Jan's access should be revoked (even if it does make requests take longer and is less convenient)

Business is always concerned with what bad event can happen?, a concept in the cybersecurity known as adverse impact. Examples of adverse impact includes

• Unexpected downtime
• Data compromise / exfiltration
• Data corruption

As a company size of 500, you should be at the maturity level where you company IT should be adopting standards / procedures / best practices. I understand a certain degree of flexibility is needed in very small organizations for business efficiency, but such constraints generally lessen as companies grow.

When your boss says that using domain admin level administrative access to accomplish tasks that does not require privilege elevation is "more efficient", agree with him first. However, also disclose the risks to him of using such highly privileged account to do these tasks, and then ask your boss whether he is prepared to accept such risks. In this manner, you are not imposing anything on your manager, but providing him with full transparency. Ultimately, proper risk management in a company rests with management.

People always go to Jan rather than myself because Jan already has (now illegitimate imo) access.

One of the reasons this may be occurring is that IT Security function is often (wrongly) associated with being "the department of NO". In other words, security is seen as a hindrance to business success, not as something essential for a company to achieve its goals. Your coworkers may be going to Jan because he was able to help them more quickly and efficiently, albeit illegitimately. As to what you can do, position yourself as a partner, someone who understands what your coworkers are looking for and is willing to listen openly. This does not mean not following security best practices. In my experience working as a security analyst, and former auditor, bypassing of security policy is almost never deliberate. Rather such action is frequently due to business necessity or simply ignorance of associated risks.

You have not asked for this, but below are some additional information security best practice when doing access provisioning, given you seem to be fairly security conscious, and have good standing in your company, but

Using separate accounts - normal user vs privileged user

In addition to only elevating access privileges when needed, it is good practice to create separate, normal user accounts for everyday work rather than using one account with administrator access for all IT work. As a domain admin, Jan has access to do anything he wants to all resources in the AD domains in which he is a domain admin. The effects of a mistake / credential compromise / malware infections etc. when using domain admin accounts in AD on other IT resources in the domain can be severe and widespread. In addition, there is inherent risk when Jan is terminated, especially involuntarily. Using a separate account would mitigate somewhat the effects of mistakes / sabotage. I am not saying Jan is malicious, just that theoretically he could be. IT security is concerned with mitigating risk that threatens business mission in line with risk appetite, so given Jan represents a potentially high risk actor, such step described here seems reasonable.

Periodic review of access rights

In your case, Jan did not have privileged rights removed when he left his old role. Creating accounts in AD can usually be done at the OU level via privileges delegation so domain admin rights are not needed. A process of periodically reviewing user access - especially privileged access can detect when inappropriate rights are retained as in Jan's case.

Answer 4

A simple, anonymous letter to your IT security department will solve this issue for you! Just beware with this tactic however, considering you've already talked to your boss about it - it may be obvious it was you.