Security

Ask something
Discussion Locked

IS mgr utilizing other usernms regularly

0 helpful
7 replies

by mtsal_uno

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I'm a Network assistant for a 5 site clinic organization. Is it proper for an IS manager to log in as other users and use their usernames as if it were their own when users are away or is this against Networking protocols? If I understand correctly, if an IS mgr needs to view or access certain files on another users desktop, they should have those privileges already set on their username. I think our IS mgr is lacking some serious Network Administrative skills. By the way, we utilize a Winnt 40 and Sco Unix servers with 49 Win98 workstations. Your feedback is appreciated.

7 replies

by dougbehrends

You are absolutely correct. Data access should be managed via ACL's not the sharing of UID's and passwords. As a point of reference, at our company it is a serious offense to divulge your password to another individual. It is grounds for disciplianry action, up to and including termination!!!

Besides, it is just bad security practice to do this. Think about the implications of "identity theft". If someone has your ID and password, anything they do (fraud, hacking, e-mail harrassment, etc) while logged on as you is your responsibility and will be attributed to you, not the other person.

Ask the manager if you could "borrow" his ID and password for a little while !!!!

by ebob

The situation you describe is not "against Network protocols" but it really should be against your organisation's security policy. And it's NOT a matter of this manager "lacking some serious Network Administrative skills", either.

But now you probably have a tough political situation with which to deal. It sounds as if your organisation needs to re-write security policies (or to develop some if there are none). Have somebody from outside of I.S./I.T. approach this manager with a project to develop these policies. Since such policies are REALLY the domain of H.R., this would be where I would go to find somebody to sponsor such a project.

There are alot of resources around TechRepublic to help you define what should be in a policy, including reinforcing that user IDs and passwords must never be shared. You'll also need to implement a password change protocol (at least every 6 months!), and a protocol for users to gain access to files and shares to which they currently do not have access.

by dwilcox22

Whether or not your IS manager has network administrative skills is not the issue. This is an ethics issue. Most companies have an ethics policy and a representative that deals with those infractions (sic). It depends on whose machine he is logging into (HR, Finance, CEO?). It appears this individual does not want to leave a trail as to what is being accessed. Salary information or what ever.
We in IS must be trustworthy and not have the appearance of impropriety.

This discussion is closed to new replies.