2

I am a recent new hire (I am a data scientist on a work visa) and I've gone through all the training for my job. During my first month, I met someone named "Pete" in my office who works in infosec. Pete is rather vocal person and tends to carry a long converstation, even if you're not actively paying attention to him. He also is extremely loud, opinionated, and comes up with make believe medical aliments such as COVID-20. Every interaction I have with him seems to revolve around my security questions to login to my PC. For example, he'll ask something innocent about my cat and his name and then ask "Is that your favorite first pet"? Or he'll mention his childhood home and if I remember what street mine was on.

I've asked him to stop directly, but he doesn't seem to quit and other people don't seem to mind as that's just "oh that's Pete being Pete!". I brought this up the first time to HR and they don't think it's harassment/against any rules.

Is there some sort of secret word I can use to get this to stop or am I doing something that is singling me out?

14
  • 7
    Get him to stop asking you dumb questions? Give him dumb answers. How exactly is he "challenging" you? This seems annoying but I'd stop short of calling it harassment.
    – joeqwerty
    Feb 4, 2022 at 21:04
  • 2
    Give replies that could be insulting, like your cat’s name is “total idiot” etc then it becomes more fun when he realizes…
    – Solar Mike
    Feb 4, 2022 at 21:09
  • 4
    I think that would get me more unwanted attention if I insult him back, even indirectly Feb 4, 2022 at 21:13
  • 2
    I've been polite with him many times in the past before I saw it as a problem. He only does this specifically to me (as far I as can actually hear/see), but he does spend an enormous amount of time talking to various people randomly. You are right, I don't understand what his work is and why am I involved. Feb 4, 2022 at 21:18
  • 3
    @Antonia-InsideOut, As you mentioned that he does this to "various random people", trust me on this : "Pete does not single you out". He just likes to talk to people and is not aware that some people may not enjoy that kind of conversations. The best course of action is to calmly focus on your job. (I would definitely not go to HR over this matter.) Feb 4, 2022 at 21:22

6 Answers 6

12

I keep getting challenged by internal infosec for no reason

You aren't being challenged by infosec. It's just Pete.

Is there some sort of secret word I can use to get this to stop

It's not much of a secret, but try "No!"

  • Q: What's your cat's name? A: No!
  • Q: Is that your favorite first pet? A: No!
  • Q: Do you remember what street your childhood home was on? A: No!

Once you stop playing the Pete being Pete game, it will eventually stop.

Either do that or learn to tolerate the silliness like others have.

5
  • 6
    Hey, Pete is doing the infosec job! The only thing I find surprising is a peculiar absence of the mother's maiden name in the list of questions...
    – Lodinn
    Feb 5, 2022 at 0:28
  • 6
    I always fill out those security questions with bogus information. All that is important is you can respond with the correct answer when presented with the question - not that the information is factually correct
    – Peter M
    Feb 5, 2022 at 1:10
  • 1
    Nobody likes to play a boring game. As soon as the reaction doesn't amuse Pete any more, he will stop playing
    – L.Dutch
    Feb 5, 2022 at 5:46
  • 7
    Yup, straight up broken record technique. However, I'd use 'That's none of your business' instead of 'no'. It will add weight to any formal complaints made if you can say 'he keeps asking questions which are clearly not his business and I've told him as much' and also is less likely to lead to childish 'oh, so your cat's name is no, is it? You're a weirdo' type responses.
    – mcalex
    Feb 5, 2022 at 12:37
  • 1
    I wonder if Pete has a form of Asperger's. That would be perfect for an infosec position but would annoy everyone else.
    – David R
    Feb 5, 2022 at 15:19
9

Step one, and I cannot emphasize this enough:

Make sure none of your passwords or other security information are in any way related to your personal information, like pets and mothers maiden names or street names.

Once you've done that, answer Pete's questions freely. Tell him your pet names or whatever. If he ever challenges you on this then you have a perfectly good response.

Pete: You just told me your pet's name. That's a security breach.

You: No it isn't.

Pete: Yes it is. I might be able to guess your password from that.

You: I don't use personal information in my passwords. Why, do you use your pet's name as a password? That's a massive security flaw. You should fix that, what with you being in infosec and all.

If he reports you then you have the same conversation with whoever he reports it to, minus the sarcasm.

1
  • I think that Pete once read that you shouldn't use those security questions allowing you to reset your password and is now fishing for a "gotcha" moment. These questions have indeed long been regarded as a large security risk. If any of the company resources require them (they shouldn't, but...), you should enter as much jibberish as you can to both the question and the answer field (use a password generator) and not store the info anywhere. As @DJClayworth suggests, also review your password and other security info. Then, by all means, have some fun reverting the "gotcha" moment on Pete :-)
    – Luc
    Feb 7, 2022 at 16:16
3

There is the very real possibility that "Pete" is acting on his own behalf, and not for his job in "infosec". He might "just" be fascinated by the challenge and perceived power of hacking other people's account. Or he might actually be working against your company with or without being payed for it. A job in infosec does not prove that he is on the company's side. It just proves that he is interested in such a job - and such an interest would fit both the "hobbyist" and the "bad actor" angle.

So there is one thing you should do: Ask Pete's supervisor if Pete's actions are actually sanctioned and part of Pete's job. Do so in writing. Best would be written-on-paper writing, with a prepared "I received this"-answer the supervisor can sign.

E-mail is only the second choice, since someone as enthusiastic as Pete may well be able to tamper with it. But if you use e-mail, make sure to have other superiors in cc or bcc, and make sure that they indeed received it. Put your private mail in bcc, too.

If things blow up and suddenly someone's account is framed for doing bad things, you have written prove that Pete persistently tried to get access to other people's accounts and you have also written prove that you actually warned the higher-ups about it.

Once you have it in writing that Pete's actions are sanctioned (or at least that you informed his supervisor), adopt other people's habit of saying "That is Pete being Pete.". Because no matter what happens then, you are not responsible anymore.

0
2

Ask your manager to formally schedule you in for social engineering training so that Pete will stop bothering you.

It sounds to me like Pete is trying to educate you about social engineering, a form of attack where the attackers trick you into revealing information that will allow them access to your systems. So, if you want it to stop, ask your manager to formally schedule a social engineering training session for you so that Pete can stop bothering you with it when you're trying to work.

5
  • 2
    I was gunna answer along the same lines with a slightly different take, so I'll stop. I recommend just talking to your manager and stating that this bothers you, with or without the security training. Then go from there. Feb 4, 2022 at 22:04
  • 1
    Why would someone want to sit through pointless and unnecessary social engineering training when they've already identified the social engineering that's being attempted on them? What would they learn? And how would that stop "Pete" from acting this way? Feb 7, 2022 at 8:50
  • "how would that stop "Pete" from acting this way?" They can simply tell them that they've received the training, so it's no longer necessary, and they can stop
    – nick012000
    Feb 7, 2022 at 8:52
  • 1
    If that would work, why not just say that anyway without having to sit through unnecessary training? Is there any indication at all that it would work, from what the OP has said? Is there any hint at all that this is Pete's intended goal, or that he would accept such training as a reason to stop doing what he has no reason to do anyway? This answer simply does not solve the problem. Or any problem. Feb 7, 2022 at 18:57
  • @BittermanAndy You can't tell him to stop because you've had the training until you've had the training.
    – nick012000
    Feb 7, 2022 at 19:56
2

Your mistake is taking Pete seriously and treating him like an adult. Stop doing that. He is a silly little child. Think of Pete as an annoying little brat that somebody had to bring to the office because yet another sitter bailed after one day with him.

Of course, on occasion a child will say something useful or interesting. If Pete does this, throw him some praise. Don't overdo it.

You should read up on transactional analysis. The original work is Games People Play (1964) by Eric Berne, but there is now plenty of material on the subject, including online tutorial videos.

The key concept is that of parent-adult-child interactions. You are frustrated because you would like to interact with Pete as adult-adult, but Pete insists on approaching as a child. Train yourself to react to Pete as a parent and you will be happier.

0

Turn it into a game. Have you seen the movie "Usual Suspects"?

When he asks you about your favorite subject in school, and the teacher you had, give it to him. When he asks you for your first street address, give it to him.

Just make all your answers anagrams/words of publicly available information specifically about him (or of things he's carrying in his hands, or of things you've seen publicly posted in his cubicle).

But be careful, don't answer any of his questions in writing. If there is written proof that you're leaking security information, even false information, that could still earn you a mandatory spot in his class.

Then, when new people are hired, warn them of Pete, and instruct them to do the same as you did.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .