I work in the cybersecurity division of my employer, in a lead role for close to 9 years.
Two days ago, I was working late patching and monitoring our systems as a result of a security incident that came out over the weekend. I also just happened to forget my regular access badge at home, that had elevated access to all securied areas, so had to get a temporary access badge programmed with access to sensitive building areas that only security team folks have access to , such as the server rooms.
When I left on Monday, the front desk reception people had already left. Having there being no one to check in my badge and almost no other folks at office, I left my temp badge at reception (which in hindsight is bad) I did not want to be accused of not returning company equipment so did not bring badge home that day with me.
Apparently someone else took the temp badge I returned before reception could check it in and reset the associated physical access. Yesterday, the new borrower of the temp badge returned it, having used it. The problem though, is the badge still shows in the system as having me as the registered / authorized user, not the new borrower.
Today, I got an unpleasant email from security divusion management , cc' my manager and HR, falsely assuming I had lent my temporary badge to this other person. Lending of / deliberate misuse of access credentials is strictly disallowed by company policy and can be reason for summary dismissal. Even worse, due to role in security division, expectations to follow policy is higher than for non info security folks
After review of electronic badge system access logs, I now know the identity of the person who took the access badge. I am also now able to definitively say the other person did not access any areas he was not authorized to access using my credentials. Finally, server room access logs and security cameras footage did not show unauthorized access to the room.
Update: How this turned out was I got a formal warning and my company believed it was indeed accidental , caused by confusion rather than malice. My proactiveness in reviewing logs and surveillance cameras helped my defense. So far , there has been no demotion or other job consequences outside of formal warning.
How do I minimize damage as a result of the false accusation?
I also see a system weakness in that expectations are unclear in return of badges during non working hours. Should this issue be raised when I respond?