Found out co-worker got IT to get into my computer [closed]

Question

At my current place of work, more than 1 person can use the same account on a single computer. The co-worker had initially asked why do I shut down my computer at the end of the day. To solve this and please them, I would then leave the computer on but with my password changed. The co-worker can still use the computer itself if they are too lazy to turn it on, just not have access to my account. We are all given our own email accounts and I changed my default password upon first use of my computer.

Today I could not log on to my machine. After mentioning the issue to IT, I was told by IT that my password was back at the default one as a result of my co-worker requesting access. I copy my coworker on the work I do, so there should be no reason for the coworker to need access to my individual account

I alerted management and stated I was not comfortable with an employee gaining access and asked if this was an authorized practice as it compromises the integrity of my work. Management said they would address my issue later. EDIT: They have not and I have yet to see anything like this in their employee handbook.

How do I build a business case to management that current practice of shared accounts exposes the business to liability and is not a secure practice?

Answer 1

You work for a place with a default password that everybody knows. IT agrees to requests to "set that other guy's password back to the default that I know." You told someone about this, and that someone did not immediately fire the requestor and the agree-er. You know what that means? It's not your account. It's just an account that everyone can use.

Sure, your coworker could have signed into your machine on their account. Maybe they even tried that. And something wasn't installed or wasn't configured, and for some reason they needed to do that thing on your computer. So they used your account. That's how things work in this company. Or, an email was missing and even though you always cc them, they had to know whether "no patience didn't deal with this important thing" or "no patience dealt with this thing but didn't cc me" so they needed to look in your email.

This is clearly how things are at this company. I very much doubt you will be able to change it. It isn't even necessarily bad. When we had phones on our desks, anyone could use "my" phone to make a phone call when I wasn't there. Anyone could put a paper letter in my outbox and the mail guy would pick it up. Anyone could tape up a political sign in my office window when I wasn't in. Somehow businesses got by despite this total lack of security. Your employer feels this way about the computers and the accounts.

Never keep anything personal or private on that machine. Accept the default password and live with it. Check once in a while to be sure someone isn't doing bad things with your computer, and report to IT and management if you find warez or worse on it. Think of it like a landline phone or a company car or a forklift in the warehouse. That's how your employer thinks of it.

Answer 2

You have a serious problem here. Your co-worker wants to use your computer, why? There are NO good reasons for this.

Your organization SHOULD have a policy that everyone have their own passwords to their accounts. IT will have their own account. Nobody else should be able to create accounts on your machine.

The reasons for this are control and traceability. If your co-worker used your computer to for something illegal or against company policy it would come back to you, not him/her and since they use 'your' account there is no traceability.

Some things you need to do to PROTECT YOURSELF.

1. Send IT a forceful email, you will need this if the behaviour continues and you are accused of something illegal or unethical. Inidate you are concerned that your co-worker requested unnecessary access to your workstation. Indicate that you are changing your account password for YOUR protection (and possibly compliance with IT). Indicate that you would like to be notified if anyone else requests access to your workstation in advance. CC your supervisor.

2. Turn your computer off. This will leave a traceable log should someone access your computer there will be a record that it was shutdown and then restarted. This is for your protection again. If someone is using your computer after hours for something illegal or against policy, you will be able to indicate that on that date you shut down your computer and left the office at such and such a time. This may be an IT issue though. Often times IT will push images after hours. Check with them, not your co-worker, on this.

3. Keep CC your co-worker. Keep it professional. Politely ask that they NOT use your workstation. If they need something, they can ask you and you will provide it. Again this is for your protection.

The exception to these guidelines, and your post did not indicate this, is 'hoteling'. This is where individual workers have floating profiles and move from desk to desk and machine to machine regularly. Their accounts follow them around. This still means they have individual protected accounts though.

This is all about you, not them. Hold your lines. Management has show apathy towards the situation and IT seems lax. This is not a good environment for you. If somebody is doing something illegal or unethical there is no traceability and they will scapegoat someone. Hint, it won't be your co-worker, he/she is too well connected for that if they can get IT to grant them access to random co-workers computer.

Lastly, find another job, this is not a safe environment.

Answer 3

Management seems slow when it comes to addressing this co-worker. How do I address my concerns with them on this issue?

You've already brought it up with "management" and gotten their response, so pushing the issue further there might not be wise, at least right now. If the situation continues and nothing is done, it wouldn't be inappropriate to ask again later, but take them at their word and give them a chance to deal with it "later." It may be that there are already wheels in motion that you don't know about, like an effort to transfer the problem employee elsewhere, or get rid of them altogether. Or, they might just not have time to deal with your issue right now.

It's certainly strange that your coworker insists on having access to your account. Since you're not getting immediate help from your manager, consider talking to your coworker and finding out why they feel they need access to your account. You might or might not get a straight answer, but you won't know until you ask.

I'd also talk to the IT folks and ask what the policy is on passwords and sharing accounts. There's little point in even having passwords if people are sharing accounts, after all. It may be that your coworker lied to the IT folks in order to get them to change your password, and if so, it would certainly be useful to know that.

From your description, it certainly sounds like your coworker is up to no good, so watch out for yourself.

Answer 4

You did not mention important information in your question:

1. In which sector of the market you work
2. Whether your company is publicly traded in the US stock market
3. Whether your company handles government contracts or is in an regulated industry such as banking (Gramm-Leach Biley) or healthcare (HIPPA).

The answers to these questions matter. If your company is publicly traded in the US, then it is subject to the Sarbanes Oxley (SOX) law, and specific sections, namely section 404 mandates personal responsibility for senior management in establishing internal controls over financial reporting.

While no specific internal controls are listed in the SOX law, business processes that impact the integrity of financial reporting of a company are becoming more and more integrated with IT. Hence inadequate IT security / controls in your company is no longer just an IT security problem, but a business problem, which costs the firm money. Senior management in the past have had gone to jail for false attestation under SOX.

Even if the the SOX law does not apply in the case your company is privately held, such practices are still extremely ill-advised from both a business and IT security perspective. Consider implications of what your company's current practice mean in questions below.

• As accounts are shared and everyone knows the common default password, individual accountability (non-repudiation) is lost.

How can you trust approvals on any important business documents if the you / the company can't be certain the documentation is actually from the person who the message states it is from?

If your company were to be audited, how will your guarantee a clean audit trail that is not compromised? Audit logs become meaningless in such a situation, negating individual responsibility

How do you know that an intruder is not on your company network? Can you really be sure the person who an email for example, is actually a legitimate individual and not someone malicious, especially in the case of remote users?

Finally, you can let management know that current practice exposes themselves to risk. They can no longer deny individual responsibility if something were to break, as accounts are shared. Rational management should be able to realize that by stopping such practice, it serves their own best interests.

If your management insists in keeping the policy as is, the best bet is to establish frequent audits of such computers and a "designated owner within IT" to be held responsible for accounts and password management. Management should decide and document its decisions in a policy on how shared accounts can be used such as which users are authorized to use your particular account to logon. Read this article from SANS for detailed best practices around shared accounts that can help you in your discussion with management.