2

I recently switched to a new laptop at work, so IT had to set it up for me and move my files over. The problem is they asked for my password to do it. I balked, and after some hemming and hawing on their part, they agreed to attempt it without the password. It seems like this is their standard practice, and I got the feeling I'm the only person that has ever not provided their password.

I work for a very large company, and they are concerned about security. This isn't some rinky dink operation, so I struggle to believe that it is corporate policy for IT to ask for passwords. I suspect it's a practice specific to the local IT at my office, and that corporate wouldn't be too happy about it.

So my question is, should I report this practice to someone higher in the food chain? I'm sure IT is just trying to do their job effectively, and I don't want to get anyone in trouble for that. It'd also be obvious who made the report, and I do not want to get on IT's bad side. It seems like a terrible practice to me, but they presumably do it for a reason, and I may do more harm than good (especially to myself).

Should I say something about them requesting passwords or keep my mouth shut? If I do report it, is there a way to minimize the concerns outlined above? I don't want to get anyone fired, and I don't want to make any enemies. I just want my local IT to use good security practices, whatever that is to my company.

Note: I'm not asking if this is a reasonable practice, or if I should give them my password. I know I shouldn't, and I didn't.

closed as off-topic by Draken, gnat, Mister Positive, JasonJ, IDrinkandIKnowThings Apr 12 '17 at 15:22

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking advice on company-specific regulations, agreements, or policies should be directed to your manager or HR department. Questions that address only a specific company or position are of limited use to future visitors. Questions seeking legal advice should be directed to legal professionals. For more information, click here." – Draken, gnat, Mister Positive, JasonJ, IDrinkandIKnowThings
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Do you have the request for the password in writing? I understand most conversations with IT are over the phone or in person. I would try to get this regardless of if you use it in future. – DavidT Apr 12 '17 at 8:06
  • 5
    Never give out a personal password. If they need access to your PC, they should be able to change it. At the very worst if they force you offer to change it to something they want. Never disclose your personal password. – Magisch Apr 12 '17 at 8:33
  • 2
    If I were you I'd set a temporary password for that purpose and change it back as soon as IT team is done with their work (and the sooner the better). @Magisch is absolutely right, never disclose your login credentials. Not only do you risk giving away private data, but also allow for unauthorized actions on your behalf. – olegst Apr 12 '17 at 8:53
  • 1
    Normally IT would have administrator rights over your laptops and they sohuld not have to ask you for your password. – Max Apr 12 '17 at 11:11
  • @Max - Admin rights give them rights the the computer not the users personal directory when "My Documents" and other important file folders are stored. – IDrinkandIKnowThings Apr 12 '17 at 15:21
5

I work for a very large company, and they are concerned about security. This isn't some rinky dink operation, so I struggle to believe that it is corporate policy for IT to ask for passwords. I suspect it's a practice specific to the local IT at my office, and that corporate wouldn't be too happy about it.

Then you most likely have a data protection officer or someone who is in charge of IT security in general.

It's correct to never give out your password. Anyone from IT who has the permission to access your files can reset your password or have it reset anyways. It's important that you never disclose personal passwords.

Report this (anonymously or not, your choice) to the relevant IT security officer in your company. I suspect the people who dealt with you will get a railing or disciplinary measures over this. Especially since it's a big company.

  • But I don't want them to get disciplined over it, and i definitely don't want them to blame me for being disciplined. That's my problem. – Kat Apr 12 '17 at 20:21
  • Actually, I'd say that anyone from IT with permission to access will have an administrative login and password that will allow them to do so, without messing with the user's password or account. – PoloHoleSet Apr 12 '17 at 20:25
  • @PoloHoleSet Sometimes, you really need to go in with the user's account, for instance to configure it on a individual pc, if you're not using thin clients. But in these cases, you give the user notice and then reset his password, and let them change it back once you're done. These PW resets are also logged, so there's a clear audit trail from when to when IT had direct control of a user's account. – Magisch Apr 13 '17 at 4:08
2

As someone on the receiving side of such information (information security team), we do appreciate when it reaches us. It can be a symptom of

  • a phishing attempt
  • bad practices

In any case it is handled anonymously, we do not want the messenger to be shot.

  • But they told me I'm they only person that didn't give out their password when asked, so it'll be obvious even if I'm not explicitly named. . – Kat Apr 12 '17 at 20:33
1

This definitely needs to be brought to someone's attention, but formally reporting it might not be the best approach. It is entirely possible that somebody wrote the process down to include "gather passwords" and now it is policy.

If your company has an IT security team, or similar, get in touch informally and just clarify the position with them. If they want to raise it in a more formal manner, they will very likely tell you (and then get on it very quickly if they are competent).

  • 1
    I like your idea of getting in touch and clarifying whether they consider it a problem or not. That would be a good first step, though I'm not sure how to handle it if they decide to deal with it formally. Thanks for being the only one to actually answer the question I asked! – Kat Apr 12 '17 at 20:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.