- Mid-sized company with multiple branches.
- I wrote the access-control (among other things) powering the smart readers and I'm entitled to a master-token.
- Brother of CEO is employed as well in a minor position due to family ties.
- That brother asked me to lend him my master-token to the CEO's office because he doesn't have access and needed a key for one of the company cars (which he's entitled to).
- I gave him the token trusting him and thinking blood is thicker than water.
- Was surprised/baffled that it takes ten minutes until he returned the token.
- Now I'm thinking what he's been doing in the office that took him so long.
- My question is if I should inform the CEO that his brother was in his office and what caveats I could expect?
- I wasn't in the office with him - I stayed in my office
- I designed the system - so all access-attempts are logged (granted & denied) including the token-code and the respective owner (in that case me) and can be distilled into a report for admin-users
CEO has admin rights to the access-control-system
The CEO was not available to me or him since he's on a business trip and I didn't expect any malicious intent under brothers.
- Maybe a little naive but I try to see the good in people until they prove me wrong.
- I also was a bit afraid of the consequences that could have happened if I deny access (maybe a rant against me from the CEO why I didn't let his own blood&flesh into his office to get a key)
I just talked to our CEO along the lines David K. mentioned in his very helpful answer and 'reported' the incident. He seemed vaguely interested and only advised me to give his brother full access - and that's what I did..
We also internally agreed on evaluating our current access policies to cover all possible incidents and creating a set of rules/methods to be applied in specific edge-cases.