50

I work in the cybersecurity division of my employer, in a lead role for close to 9 years.

Two days ago, I was working late patching and monitoring our systems as a result of a security incident that came out over the weekend. I also just happened to forget my regular access badge at home, that had elevated access to all securied areas, so had to get a temporary access badge programmed with access to sensitive building areas that only security team folks have access to , such as the server rooms.

When I left on Monday, the front desk reception people had already left. Having there being no one to check in my badge and almost no other folks at office, I left my temp badge at reception (which in hindsight is bad) I did not want to be accused of not returning company equipment so did not bring badge home that day with me.

Apparently someone else took the temp badge I returned before reception could check it in and reset the associated physical access. Yesterday, the new borrower of the temp badge returned it, having used it. The problem though, is the badge still shows in the system as having me as the registered / authorized user, not the new borrower.

Today, I got an unpleasant email from security divusion management , cc' my manager and HR, falsely assuming I had lent my temporary badge to this other person. Lending of / deliberate misuse of access credentials is strictly disallowed by company policy and can be reason for summary dismissal. Even worse, due to role in security division, expectations to follow policy is higher than for non info security folks

Addenum

After review of electronic badge system access logs, I now know the identity of the person who took the access badge. I am also now able to definitively say the other person did not access any areas he was not authorized to access using my credentials. Finally, server room access logs and security cameras footage did not show unauthorized access to the room.

Update: How this turned out was I got a formal warning and my company believed it was indeed accidental , caused by confusion rather than malice. My proactiveness in reviewing logs and surveillance cameras helped my defense. So far , there has been no demotion or other job consequences outside of formal warning.

How do I minimize damage as a result of the false accusation?

I also see a system weakness in that expectations are unclear in return of badges during non working hours. Should this issue be raised when I respond?

18
  • 34
    What does existing policy say you should have done with the temporary pass? (You say it's ‘unclear’… If policy could be read to say that you should take the pass home, then why were you worried about getting into trouble for that? Or if it seem to allow for leaving it at reception, what did you do wrong? Or if it says something else, why didn't you do that?)
    – gidds
    Dec 16, 2021 at 10:13
  • 7
    Is there security camera footage of reception, showing you leaving the pass there?
    – gidds
    Dec 16, 2021 at 10:15
  • 27
    I'd also give a strong advice to the front desk and physical security part of the building: A secure drop box for guest passes. When I worked at a bank, guests needed to deposit their guest pass in a receptacle to activate the single-person rotating door when they left.
    – cthulhu
    Dec 16, 2021 at 13:28
  • 12
    @ThorbjørnRavnAndersen Why couldn't a temp card have these permissions? And why wouldn't a temp card have permissions suitable to who it was assigned to? Dec 16, 2021 at 15:02
  • 9
    @Anthony So why didn't you just bring the badge with you and returned it the day after?
    – d-b
    Dec 16, 2021 at 15:30

8 Answers 8

152

First, take the blame. Explain exactly what you did wrong. Explain how stupid it was for you to do that. If you start off by saying that the accusation is false, then they won't even listen to what you have to say afterward (even if what you say is technically correct).

Send out that email now. Do not wait. Even if you figured out that the server room wasn't compromised, they still need to know the exact details of what happened. But please, don't start off by saying that you were "wrongly accused". In my personal opinion, what you did was actually worse, security-wise, than lending out your badge to someone else.

In your case, by leaving your badge in an unsecured location, you essentially gave your badge to a perfect stranger (that at the time at least, you didn't even know the identity of). And objectively, that is actually worse than lending out your badge to a trusted individual (although both options are really bad either way).

So explain what you did, but don't try to use it as an excuse. If it starts sounding like an excuse, then an argument will ensue, and if an argument ensues, it's not going to go your way, for the reasons I've already outlined in my previous paragraph.

Also, there is nothing more infuriating than talking to someone who tries to prove you wrong over a small inconsequential technicality. On one hand, it's like the person you're speaking to can't even seem to see the forest from the trees. But on the other hand, it's like that person is trying to prove you wrong, in a futile attempt to challenge you and get power over you.

And yes, depending on the type of employer you working for, you could be fired over the security incident itself. But in my opinion, arguing this minor point now, that's the surest and quickest way to get yourself fired, even if they had no intention to fire you in the first place.

I also see a system weakness in that expectations are unclear in return of badges during non working hours. Should this issue be raised when I respond?

No, you can raise this issue later, if you see that the signage/process has not changed at the reception. Raising it now will send the wrong message.

9
  • 2
    I guess he didn't just leave the access card openly on a reception desk. This would be equivalent to leaving your house keys on the porch when you leave for work. Receptions typically have a sealed container for return of temporary access cards when reception is not staffed (at least that's how it works where I work).
    – Alderath
    Dec 16, 2021 at 9:00
  • 8
    "If you start off by saying that the accusation is false, then they won't even listen..." - avoiding clearly and explicitly denying a false accusation is a good way to make it seem like the accusation is actually true and you're trying to dance around the issue to put you in a better position if evidence comes out that supports the accusation.
    – NotThatGuy
    Dec 16, 2021 at 9:29
  • 38
    @Alderath "I guess he didn't just leave the access card openly ... Receptions typically have a sealed container" - if OP put the card in a sealed container, then the other person wouldn't easily have been able to take the card, this would be a much bigger security issue that OP doesn't have much to do with, OP would've presumably been following the card return policy and the question overall wouldn't make that much sense.
    – NotThatGuy
    Dec 16, 2021 at 9:56
  • 4
    @kojiro The OP is a lead in the cybersecurity division, I would imagine part of their role is to help determine these policies. It sounds like a policy the OP would write is: "Just leave the pass on the reception desk". Dec 16, 2021 at 12:48
  • 11
    @Alderath, no drop box or secured storage. Badges were stored in locked drawers for which I did not have the key. Only reception and facilities folks do
    – Anthony
    Dec 16, 2021 at 13:34
50

You DID hand your badge to another person, whether you intended to or not.

How that person got access to your badge is irrelevant, unless they stole it from your body or otherwise forced you to hand it over without them being authorised to do so.

Live up to your error, admit it, and accept the consequences. You can only hope it's not something you will get fired over, though in my experience (which is based on reading the rules in quite a few companies, never breaking them) is that a first offense will likely cause a negative mark on your performance review and possibly temporary revocation of privileges (meaning you won't be able to enter secured areas alone for a while).

You made a (stupid) mistake, admit it and don't try to hide the fact. Worse, you hiding the fact as long as you did already may well be taken far worse than you making the mistake in the first place.

16
  • 4
    Your first sentence states a literally different error than the one that happened.
    – donjuedo
    Dec 16, 2021 at 15:07
  • 30
    @donjuedo no, by leaving it unattended he lost control over it so anyone could take it. That's the same as giving it to a random person.
    – jwenting
    Dec 16, 2021 at 17:48
  • 3
    yes, he lost control -- he allowed control to pass to someone else (really bad), but merriam-webster does not support your definition. That's all I'm saying here.
    – donjuedo
    Dec 16, 2021 at 20:56
  • 6
    I think when it comes to security, it is useful to think of things in these terms. You should assume by leaving you pass lying around, you ARE giving it to a bad actor. From a legal standpoint the distinction does matter however. Dec 17, 2021 at 1:13
  • 14
    @Mayou36 what OP did is WORSE than loaning his badge to a fellow employee.
    – Kevin
    Dec 17, 2021 at 19:59
27

You're in trouble, and it's in your best interests to clear things up now.

There are 2 points that you need to address in your first response:

  1. This was an accident, you did not lend your badge, you left it in an insecure area.
  2. The lack of due procedure to return temporary badges may lead to further such accidents.

I disagree with answers advising to just be "passive" about it; clarifying the intent is primordial, in my own view, as there is a massive difference between consciously breaking the rules and accidentally breaking the rules -- even if in this case the accident may have worst consequences.

The difficulty is in finding the right phrasing. You do need to take responsibility, and you do not want to appear to be making excuses or to appear to be shifting the blame.

Still, despite the difficulty, it's in your best interest to address the above 2 points.

Hence I would suggest a response in 5 parts:

  1. Clarify your intent: you did not intentionally lend your badge to another, you made the mistake of leaving your badge in an insecure area instead.
  2. Own it up. It was a mistake. Apologize, promise not to do it again, etc... Make it sincere, and not over long.
  3. Show your recovery actions. As soon as you were pointed your mistake, you took explicit steps to ensure that no unauthorized access occurred from it.
  4. Suggest improvements to the temporary-badge return procedure in the case of absence of authorized personnel at reception. The locked drop-box is a really nifty idea, the other is clarifying that should the drop-box be open the company would rather employees keep the temporary-badge with them until it can securely be returned.
  5. Don't end on the suggestion -- it could be perceived as blame-shifting -- and instead put a one-liner reiterating that you own up to your mistake and will endeavor to ensure that it won't happen again.

These 5 parts contain the 2 important points -- clarification and concrete suggestion -- while ensuring that people do see you taking responsibility for your mistake, and driving the company forward.

I hope for you that your company favors blameless post-mortem to the hot potato game, and showing that you are reactive (reacting upon being notified) and proactive (taking steps to handle the immediate threats, and being thoughtful about systematically preventing re-occurrences rather than hoping) will hopefully help fixing the dent in your credibility.

2
  • 1
    I would end with "it's funny, I used to be judgmental when users made security mistakes, now I can see how easy it is to have a lapse". Dec 16, 2021 at 23:34
  • 2
    @Harper-ReinstateMonica: Not sure about the "funny", may not strike the right mood. Dec 17, 2021 at 8:15
16

How do I minimize damage as a result of the false accusation?

Explain that this was poor judgment on your part, that you understand the potential ramifications and consequences, and that it won't happen again.

I also see a system weakness in that expectations are unclear in return of badges during non working hours. Should this issue be raised when I respond?

You should address this issue in your response, as it's related to why you did what you did. Ask what the policy is in this scenario and ask that it be published with the rest of the guidelines and policies.

6
  • 7
    If as seems likely the issue is that the company doesn't have a process for returning temporary badges after hours, I'll suggest proposing what my previous employer did. There was a locked dropbox for temp badges at the reception desk, on your way out you dropped your temp badge into the box and it was processed the next morning. Also our temp badges didn't have access into the most secure parts of the building; part of the price you had to pay for forgetting your badge was the embarrassment of having to ask coworkers to open some doors for you. Dec 16, 2021 at 5:52
  • 9
    @DanIsFiddlingByFirelight I would just add to your comment, if an employee goes to use the dropbox and they realize it was left unlocked, an employee should still have enough common sense to say: "I better take this home" rather than shrug and go: "Well, I'm following the policy" and simply drop it in. Dec 16, 2021 at 12:44
  • 1
    @Dan Fiddling, correct. Policy addressing the return of the temp badges is missing, which led to this incident as otherwise I would have followed it
    – Anthony
    Dec 16, 2021 at 13:43
  • 13
    @DanIsFiddlingByFirelight in some/most/all companies, allowing someone through a secured door behind you (called "tailgating") is also a violation of security policy. While it's commonly ignored, asking a coworker to let you into a secured area won't cover you. I worked at one place where we had no conference room on our side of a door, so while 15-20 of us would troop through the held open door, each of us had to swipe our badge "to be on the safe side"...
    – FreeMan
    Dec 16, 2021 at 13:45
  • 6
    Just pointing out, @DanIsFiddlingByFirelight, that "ask coworkers to open some doors for you" is frequently a policy violation in and of itself and could have gotten both the OP and the coworker into (possibly more) trouble. I agree that the OPs company definitely needs a (better) policy on after-hours temp badge return.
    – FreeMan
    Dec 16, 2021 at 14:38
10

Let's face it. You've made a bad mistake, which is completely unreasonable for someone in your position to make. If you are not fired, it's likely the company has significant issues that need to be addressed around permissible standards of behaviour, and it's likely that there needs to be policy changes so mistakes like this in the future are met with terminations.

You should get on the front foot and explain exactly what happened, how your behaviour was fundamentally flawed, and the potential remedies that they could take (excluding firing you.)

Because you are a lead in the cybersecurity division, you are able to see the potential remedies for such a situation. You should suggest that you undertake the most onerous of trainings available. And you should be very eager to undertake them.

Depending on employment law in your jurisdiction, if you are fired, you may be better off asking if you can resign rather than be fired.

And, as a side note, you justification for leaving your pass in reception doesn't make a lot of sense. You should have absolutely taken the pass home. Without justifying your own behaviour, you could suggest improvements to policy to ensure no other employee is unsure what to do in such a situation.

8
  • 20
    "If you are not fired, it's likely the company has significant issues that need to be addressed around permissible standards of behaviour" - well then, I hope every company I ever work for has "significant issues that need to be addressed". I personally much prefer for years of good work tp be able to counteract (to a reasonable degree) someone making one mistake due to bad judgement involving unclear policies that really should be clearly defined, when that mistake didn't appear to result in any negative consequences for the company or anyone else.
    – NotThatGuy
    Dec 16, 2021 at 9:53
  • 13
    @NotThatGuy I think we can agree that there are various degrees of mistakes. To leave a pass with elevated security permissions, in a place that is public facing, is a pretty serious transgression in my book. The OP's role in the organisation suggests they deserve a higher degree of scrutiny. In my mind, they are either blindingly incompetent, or acting with malice. Dec 16, 2021 at 12:31
  • 8
    @NotThatGuy The thing is, I don't think the outcome really matters. I think someone who makes a minor error leading to a very bad outcome shouldn't be "punished" more than someone that makes an extremely bad error which, due to luck, doesn't have a bad outcome. Dec 16, 2021 at 14:19
  • 3
    I really don't think employers should throw their employees under a bid to satisfy the mob, or to satisfy shareholders, etc. They should apply standards consistently according the behaviour itself. Dec 16, 2021 at 14:58
  • 10
    @NotThatGuy, I think it is fair to treat OP based on their position though. If OP were an intern or low-level employee that didn't know any better, this could be written off as a teachable moment. But a 9-year veteran of the company, and lead in the security department no less, should really, really know better. Malice or not, at their level this kind of mistake calls everything into question.
    – Seth R
    Dec 16, 2021 at 16:10
8

I left my temp badge at reception

Great, now prove to me that this was not a malice plot; aka, prove a negative. Good luck...


Even worse, due to role in security division, expectations to follow policy is higher than for non info security folks

No kidding...


How do I minimize damage as a result of the false accusation?

The accusation seems legitimate, actually.

Have you had a chance to explain yourself or is this accusation a "one-way street"?


I also see a system weakness in that expectations are unclear in return of badges during non working hours. Should this issue be raised when I respond?

Are you trying to get immediately terminated and escorted by security?

Might as well try to accuse the front desk people checking in badges as being the true system weakness. Hint, don't do this.

The only weakness is that the expectations were unclear to you; this part you can mention and request clarification. If they cannot readily produce clarification then it will become apparent that there could be some missing instruction but as a 9-year cybersecurity employee you are expected to use sound judgement at all times.

3
  • 3
    This answer is nonsense. Guess what... humans are fallible. Any reasonable security practice considers this fact and takes it into account. The OP here is trying to correct the problem and mitigate it from happening again. Any reasonable management will be wanting to do the same thing, and OP has part of the solution. Of course it should be included in this e-mail. I don't know what company you work for, but I sure hope you're not in management. Attitudes like yours are a great way to get people to hide things... which I assure you is not good for security. Dec 17, 2021 at 7:05
  • 2
    @user1234567890abcdef Agreed, hence the "Have you had a chance to explain yourself or is this accusation a "one-way street"?" line. If nobody had used the badge then OP would have dodged a bullet but the fact of the matter is that someone else did use it. As an admin, it's akin to leaving my SSH screen open while I go grab a coffee. There's no hard and fast rules set forth by my supervisor but this would fall under "unsound judgement", no?
    – MonkeyZeus
    Dec 17, 2021 at 15:42
  • 2
    I agree with @MonkeyZeus. If a company is large enough to have security cards, then their security admins are undoubtedly expected to have a fairly thorough understanding of best security practices. Leaving your security card on your own desk because you were busy and forgot is one thing... leaving it on a public reception desk because "Eh, I don't know what to do with this" is totally different. From a manager or HR perspective, the first is being fallible whereas the latter is being incompetent.
    – Omegacron
    Dec 18, 2021 at 2:31
4

Personally I would take the middle ground between these answers. simply respond with the facts. No 'apologies' or 'defense' just "I did not give the badge to {other employee.} I left the badge in reception as I left on Monday night at {time}, I can only assume someone re-issued the badge without resetting the owner'

Simple, gets your side of the story in, and doesn't admit any blame.

7
  • 7
    I would also add that you've checked the access logs and camera footage and there was no unauthorized access.
    – ventsyv
    Dec 16, 2021 at 17:23
  • 1
    Not admitting blame in this case is the wrong thing to do and will have a real possibility of indicating the complacency is continuing. Dec 16, 2021 at 21:37
  • 3
    One key question the company would likely ask themselves is whether this employee is a security risk for the company (and, if they are, fire them). If the employee doesn't acknowledge that what they did was wrong, then the answer to that question is much more likely to be "yes".
    – NotThatGuy
    Dec 17, 2021 at 11:59
  • 1
    @StackerLee, a judgment that is wrong in hindsight does not necessarily amount to "blame". An essential part of the behavioural routine, the attendance of the security desk to handle and cancel returned passes, had already failed. Tired workers dealing with unfamiliar situations will make a variety of judgments, not necessarily the most desirable ones.
    – Steve
    Dec 17, 2021 at 14:34
  • 4
    @Steve a serious error was made, regardless of context. It needs acknowledging. To decline to do so risks being read as either arrogance, complacency or denial, and if so, each will count against OP in HRs assessment. Dec 17, 2021 at 14:46
-13

Do not admit anything, defend yourself, it is not your fault

First of all, you had to work late at night. Unless you started original mess, you basically had to clean up for someone else mistakes, and is no wonder you forgot your own badge. Situation is akin to calling doctor in an emergency from his home, and than complaining because he did not bring his white coat.

Then you had to do what you did with temporary badge. Again, it is not your fault reception was not working. Nor it was the fault of people working there, it is an organizational flaw. Also, you are not to blame if someone stole temporary badge from reception, or if guys working at reception did not check access rights of said badge before handing it to someone else.

Finally, no harm has been done. Person who got the badge after you did not do any damage.

My personal hunch is that somebody tries to scapegoat you for the original incident and for the all organizational flaws with reception, system of badge access. As they say that attack is a best defense, they are now attacking you for something that was their job to do. I would retaliate in kind, would gather evidence of their wrongdoing and present them to higher management if they insist on these accusations. In the whole affair your only mistakes was not bringing your badge from home, which is minor, especially if you were being called in an emergency late at night.

Also, depending on your locale and employment laws (hiring and firing at will or not) you could talk with some lawyer about your options. In any case, do not admit anything, do not sign anything, do not voluntarily leave your job unless you find some other position.

1
  • 1
    Comments are not for extended discussion; this conversation has been moved to chat.
    – Lilienthal
    Dec 30, 2021 at 20:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .