Security

Ask something
Discussion Locked

IS mgr utilizing other usernms regularly

0 helpful
11 replies

by mtsal_uno

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I'm a Network assistant for a 5 site clinic organization. Is it proper for an IS manager to log in as other users and use their usernames as if it were their own when users are away or is this against Networking protocols? If I understand correctly, if an IS mgr needs to view or access certain files on another users desktop, they should have those privileges already set on their username. I think our IS mgr is lacking some serious Network Administrative skills. By the way, we utilize a Winnt 40 and Sco Unix servers with 49 Win98 workstations. Your feedback is appreciated.

11 replies

by ntoz

It could be that the IS manager is getting around taking ownership of the files in order to view them. I as the end user will have creator/owner, thus full access permissions to a file I create. In order for someone to change the permissions, they have to take ownership of the file to change the attributes. The person taking ownership of the file cannot give ownership to a file thus it becomes obvious to the end user that someone has taken the ownership and made permission changes and perhaps viewed the file.

Pete

by mtsal_uno

I know our IS Mgr is not taking permissions on files when she's logging into other's PCs using their user names. Ever since my organization received a "Unionization" notice two weeks ago, she's been logging in as others onto to their PCs. Thankyou for your reply though.

by ntoz

Exactly, she is not taking permissions! By logging into the systems of these users, she doesnt have to take permissions. Also if your using exchange server, she might be reading the email. Many admins dont know any other way of doing it. Your missing the point, in order to avoid having to take permissions, she is useing the users own identity. Thats my point. BTW what she is doing may be highly illegal, depending on what it is, interfearing with the leagal right to form a union might be a big no-no.

Pete

by mtsal_uno

As far as I'm concerned, the IS Mgr here was hired because she new what to say and NOTHING ELSE. I agree with the "identity theft". If you know of any software or Win98 utilities that monitor who and what time someone logs in, please share. Thankyou.

by ntoz

Exactly, she is not taking permissions! By logging into the systems of these users, she doesnt have to take permissions. Also if your using exchange server, she might be reading the email. Many admins dont know any other way of doing it. Your missing the point, in order to avoid having to take permissions, she is useing the users own identity. Thats my point. BTW what she is doing may be highly illegal, depending on what it is, interfearing with the leagal right to form a union might be a big no-no.

Pete

by dougbehrends

You are absolutely correct. Data access should be managed via ACL's not the
sharing of UID's and passwords. As a point of reference, at our company it is a
serious offense to divulge your password to another individual. It is grounds for
disciplianry action, up to and including termination!!!

Besides, it is just bad security practice to do this. Think about the implications of
"identity theft". If someone has your ID and password, anything they do (fraud,
hacking, e-mail harrassment, etc) while logged on as you is your responsibility
and will be attributed to you, not the other person.

Ask the manager if you could "borrow" his ID and password for a little while !!!!

by mtsal_uno

As far as I'm concerned, the IS Mgr here was hired because she new what to say and NOTHING ELSE. I agree with the "identity theft". If you know of any software or Win98 utilities that monitor who and what time someone logs in, please share. Thankyou.

by mt_salazar

Does Win98 have a utility or feature that can track when and who logs on a pc? If so, where can I find it? Thanks for your replies.

This discussion is closed to new replies.