HR Records on network

Depending upon your Network, Server and Client operating systems you can restrict access through standard file sharing mechanisms. On top of that, you should use strong encryption to ensure that even system administrators cannot view the docs.

To improve data accessability and data integrity.

The CEO wants the data on the network because he considers the data valuable enough to let it rely on the failure and disaster resistent technology of the network.

But who's gone retrieve the data in case of a disaster?
The network administrator!

If the CEO wants to be the only one with acces to the data, then he will be the only one that can make redundant copies of the data and also the only one who can recover the data from these redundant copies in case of a failure or disaster scenario.

Furthermore this strategy where certain company critical information is only known and retrieveable by one person, makes the company absolute dependant on that sole person. This is frustrating for coworkers and desastrous for company and coworkers. When this person is no longer able to perform his function, the company wil also fail to function.

To my opinion, this is kinda like a pharao that would want his slaves to accompany him in his tomb.

By placing the files in a Network Directory, only give access to the required people and remove all administrators from the permissions. The question is, if the CEO wants the personnel files on a network, but noone to have access, then why put themon a network?

By placing the files in a Network Directory, only give access to the required people and remove all administrators from the permissions. The question is, if the CEO wants the personnel files on a network, but noone to have access, then why put themon a network?

Scan the files up to a folder you've selected and then only give him permission for that folder. Map him to that folder and voila!

still relies on trust: who can look into the logs directly?
The administrators!
It can be logged yes, and a trigger can be set to report to a certain user account or email.

But is it always traceable?
Cleaning the log is a bad idea because this generates an event: " the log was cleaned by 'the evil administrator'".

Just intentionally corrupt the log, the next person that wants to view the log gets the error that "the log could not be retrieved".
He wants to solve it by cleaning the log and he gets a fresh new log with one message: that he himself has cleaned the log, so he is suspect number one.

I tested this with on a windows 2000 testserver, do the following: 1. give yourself the required systemrights to overwrite the logfile. (the security events are now added to the log butwe get rid of them in the next step) 2. overwrite it with binaries and make sure there is no EOF character in or at the end. (checkdisk will find this to be a fault but nevermind) 3.remove your rights. The system will not be able to write this event to the log because it doesn't find the end of the logfile.

Voila: hacked without a trace.

A user must trust his network administrator like a voter trusts a politician or a VIP trusts his bodyguard, a patient his doctor, etc...

Customer and serviceprovider must agree on how the work is performed, this must also include the oportunity for the consumer to check the quality of the work.

If the client can't check the quality of the work, he should seek another provider if he(=the client) is worth his money.

still: the administrator must exclude himself out of the ACL, or allow the users to exclude him out the ACL.
And what's even more important: the administrator must be so fair to not keep a copy of the users ID-file, which the administrator generated himself and distributed to the user, wheter it is automaticly by installation or handed out via a diskette.

trust is still involved like always...

When a person is employed in an organization, one is given a Job description. It is an employee responsibility to ensure that he/she is accountable for all that is listed in that JD, e.g. Network Administrator. In terms of security, the NA is accountable for all secured access. The NA must implement several measures to demonstrate to his CEO that an audit trail can be in place to track access to data or folder.
The data/folder can also be restricted to specific personnel in two ways. I must assume that this data is accessed by an Application. First level is "access to the folder" and second, "ensure that you need a password to view/edit the data/info". In the first level, even the NA can be restricted to access the folder(Windows NT environment).
The CEO may demand to view the audit trial log, to ensure that there are no abuse at anytime. Problems of trust normally occur when the subject is unclear or what security measures can be implemented by the Network Operating System.

Network Administrator
Ben Wong
Sabah Energy Corporation

Just put all the options out there and let your manager choose which ones will work.
1)You admin with his trust.
2)A higher up admins the database that could get that info anyways (but probably has to learn how to do this).
3)A third party is brought in to administer that one database.
4)Security (either through your database tools or a homegrown frontend) is placed on that database to enable only one person to see the info, but no administration can be done on the database and it will probably become corrupted, crash, etc...

With all of the options laid out it makes the choice obvious and shows how ridiculous other choices are.

Hope this helps.

hello ,
Personal files do not belong on the network even if they are yours or not personal files are personal so keep them that way.If personal files belonged on the network than you wouldnn,t be asking the question as to how. So keep your personalfiles off the net.

I have worked in various environments and our systems (client/server) are complex and have much information regarding Associates in the databases.

You, as administrator, should be trusted with such information, along with the ethical practices that you do not obtain or browse the information, just because you have access.

These records can be securely placed on a network with only the access requested, but, it is recommended to limit access to only those who need the information, and of course, the trusted Information Officer.

In complex systems, it is also possible to have logging to verify access, etc.

Hope this was helpful.

I have seen more sophisticated fights among animals; your attitude toward each is utterly sickening! Just think, we are in a new century where a palm pilot at work is almost expected, and you want to fight like idiots? Go back 200 years to do that. What we can accomplish here and now TOGETHER is unimaginable! We cannot even comprehend what we will have or think up in twenty years! SO STOP THE UNNESSARY VIOLENCE!
J

We are suggesting too serious a solution for this case study. Let us take a look at some points derived after looking through the original problem :

1) The company is small. They just purchased the first Server and it took the author 1 year to convince the CEO.
2) So do anyone actually think that this CEO, who take 1 year to decide buying a Server, will spend extra money on encryption software or another stand-alone Server just for HR dept information?
3) We don't know what OS platform they are on.

NTFS will be your best solution.

Let's assume now they are on NT Server 4.0 :

1) First, set the CEO to be domain admin.
2) Ask him to logged onto the server and take ownership of the folder which contain sensitive data.
3) Deleteall permissions except he himself and the HR dept users. Now the administrator will not be able to access the folder, unless he takes back the ownership.
4) Tell the CEO that he can periodically check the ownership status because if Administrator take back the ownership, he couldn't 'give' it back. That could be ultimately used as an evidence.

Hope we shall not give anymore 'high-end' suggestions for this case study. Remember, the company is small-sized and lacks of cash. We will have to depend on the current available equipment to provide the maximum security, which I think NTFS can do the job well.

Good luck.

5mm.
Singapore.

Explain that you as the admin must have access but access would restricted to you, the user who created the records, and if he desires, for himself. I have recently set up a admin server for my company in the same way. I showed my CEO via different security rights how folders can be shown and hidden for different users.

I really like your approach - very honest, very direct and in this case very effective.

It does, however, depend on having a history with the other person and if you're in the early stages of establishing a network (as in the case of the situation that started this discussion), you might not yet have had the chance to develop that history.

However, if you left your previous employer on good terms, you might be able to leverage your experiences there in some way.

As with other posts, yours also shows how critical it is to maintain trust because your conversation would not have had the impact it did if there had been even ONE breach that the other person could recall.

paul

There are ways to handle this, but if it were me, I would set up HR on its own smaller server (spend about 1,500 for a PC-based unit), and then restrict access to it by only providing logins for those who have to use it, namely the HR people.

Software and other solutions will prove more costly,a nd leave the admin unduly exposed.

There is NO way to lock you out as admin, and here is the sticky issue, the CEO shouldn't have access either. Too much legal exposure.

To prevent the ugly political fallout, a meeting between IT, and HR with the CEO to explaing HRIS law is necessary. People have rights to privacy, concerning unauthorized access to personal information contained in HR files. The CEO MUST be made aware of this, and trained to be able to comply, or face personal and corporate fallout from it.

There isn't room to document everything, but Here this is the best in the shortest space. One of my degreesis in Human Resource Management.

There are ways to handle this, but if it were me, I would set up HR on its own smaller server (spend about 1,500 for a PC-based unit), and then restrict access to it by only providing logins for those who have to use it, namely the HR people.

Software and other solutions will prove more costly, and leave the admin and network unnecessarily exposed to unauthorized access.

There is NO way to lock you out as admin, and here is the sticky issue, the CEO shouldn't have access either. Too muchlegal exposure.

To prevent the ugly political fallout, a meeting between IT, and HR with the CEO to explaing HRIS law is necessary.

People have rights to privacy, concerning unauthorized access to personal information contained in HR files. The CEO MUST be made aware of this, and trained to be able to comply, or face personal and corporate fallout from it.

There isn't room to document everything, but Here this is the best in the shortest space. One of my degrees is in Human Resource Management.

The CEO is inviting everything from personal civil and criminal suits to class action, in wanting info set up this way. As I said earlier, the best pollicy is for the CEO to shield himself form this stuff, and allow the HRIS folks to manage it in-house. Set it all up on a private server, preferably set up so only those in the HR group, with hierarchical access levels by functions, and sepcified primary and backup admin staff have access. The CEO could get raw, anonymouse statistical information, not inclusive of age, gender or race. Much more than this, or a copy of a resume is inviting danger.
As for the admins: they are trusted with the financial, sales, and customer data (the compahny's money), but not HR??? wassup wit dat? The adminsneed to add a doc to their personnel files stating that they will not divulge information contained in HR areas they support. Still, they will be busy enough maintaining the network's performance to bo interested in snooping anyway...

This is how we strictly our personal data. First don't the data on the network but on a PC with a large hard drive. This way you can see who access the data using Admin Tool. The PC we use have a 60Gig hard drive/w 2gig zip drive as backup. We name the drive personalD and share it out so user can see the drive. Second thing is had a meeting to find out who need to access and why they need to access the data. After finding the users have them access the data as READ & ADD only and you can still have FULL CONTROL via local login and remote login.

I read your situation & would agree with those you have talked to discouraging the proposal made by your CEO and this is how I would consider telling him not to do it - In a word or so "Hackers",disgruntled/former employees, law suits over invasion of privacy. You get the idea but above all else I would seriously ask him WHY do we or you need to have them on the net & don't say Convience - If MS can get hacked why not you
Norm - Net Monitor

We do something similar here at CR2. Each user has a directory on the network with 2 sub directories one called public the other private. As you can imagne the Public one is for shared information throughout the organisation the other is for the users personal and private information. The only people with access to this are the individual themselves and the back up administrator a/c. The point that should be made to users is that as the network drives are the prorperty of the company, any information contained therin can be viewed if neccessary.

As I stated in my previous post Encryption is a good option but many have suggested that pass words are easy to crack though I don,t think there are many who could, but if your concerned about it then make it harder.
1st set up a directory tree with several levels. Example:"RootCEO\CEO\CEO\CEO\Private"
Then give the CEO sole ownership of the "RootCEO" directory. Now have the CEO drill down to the "Private" directory and assign a password to it. Then have him assign a different password to each directory above it all the way up to the "RootCEO" directory. Now He can put the private files in the "Private" folder and it will take in this example, 5 seperate passwords to access the files. If they are also encrypted then thats another level of security.
Another easy solution (this may sound dumb but it works)would be to set up a second computer and a hub in his office. Have him store the files there and unplug the network cable from the hub to secure the files or plug it back in to share them. Add to this the directory tree example above to protect the files in the event someone gets into his office.
If thats not enough for him then tell him he needs to spend a few bucks on some older computers and firewall routers. Or dig upwhatever you can to work with. Now set up a string of subnets with the firewalls between each machine and install them in his private office. Set them up with no network shares and have him use the last in the string to store and access his private files from his office. If he needs to share the files with another dept he can temporarily assign shares to those who need it and then remove them again when they are finished. Again add to this the directory tree example. Of course now he will have to be responsible for maintenance (not to mention a lot more work for him to access and share)or give you limited access when needed. He can't have it both ways.

You're right Mike...it is a power struggle. You are king, you don't want to give up any power, you must be in control.

It is about customer service...I have a hunch you don't say "No problem".

The CORRECT, Customer Service answer would be "Mr. CEO, I am not sure how to do this, but I tell you what, I'll post a message on my Tech website and see if anyone has any good ideas how to accomplish what YOU want and for ME to still do my job"

Wait....that exactly what this guy did!
Fancy that...CUSTOMER SERVICE. Instead, you blast everyone, act like a retard with the "nazi" comment and insist that you're da bomb.

I pray that I never work at company with you and I feel sorry for all your co-workers and clients, since you don't have the first idea regarding servicing their needs.

Ken

Mike,

You have some serious issues. 1) You have no idea what the HR Department actually does. 2) Full Employment economy has zero to do with HR's role reducing, and in fact reinforces the role of competent recruiting, employee retention through training and development.

It's clear..My guess is, you screwed up and missed your Open Enrollment and spent the next year fighting with HR to reinstate your benefits since you were probably defaulted to Base coverage. Since it's NOT HR which decides this, but the Benefit provider you were probably screwed all year long.

The second scenario, you've spent time at several companies, and spent many of time in counciling sessions with your HR Generalist going over Company policy, which un-doubtedly broken many, many times.

The real issue, is you don't want anyone other than yourself and your boss to have access to your file, because it's probably a complete disaster with one Corrective action after another.

I'd LOVE to have access to your HR DB and take a scroll through your Disciplinary Action table...I bet it's great reading.

Ken

As I stated in my previous post (which is farther down on the list) Encryption is a good option but many have suggested that pass words are easy to crack although I don,t think there are many who could, but if your concerned about it then make it harder.
1st set up a directory tree with several levels.Example:"RootCEO\CEO\CEO\CEO\Private"
Then give the CEO sole ownership of the "RootCEO" directory. Now have the CEO drill down to the "Private" directory and assign a password to it. Then havehim assign a different password to each directory above it all the way up to the "RootCEO" directory. Now He can put the private files in the "Private" folder and it will take in this example 5 seperate passwords to access the files. If they are also encrypted then thats another level of security.
Another easy solution (sounds dumb but it works)would be to set up a second computer and a hub in his office. Have him store the files there and unplug the network cable from the hub to secure the files or plug it back in to share them. Add to this the directory tree example above to protect the files in the event someone gets into his office.
If thats not enough for him then tell him he needs to spend a few bucks on some older computers and firewall routers. Or dig up whatever you can to work with. Now set up a string of subnets with the firewalls between each machine and install them in his private office. Set them up with no network shares and have him use the last in the string to store and access his private files from his office. If he needs to share the files with another dept he can temporarily assign shares to those who need it and then remove them again when they are finished. Again add to this the directory tree example. Of course now he will have to be responsible for maintenance (plus a lot more work for him to access and share)or give you limited access when needed. He can't have it both ways.

Most everyone states that the administrator needs to have access to everything to be able to operate, including me. However you can still setup a folder structure which restricts even the administrator. Create the folder structure with the person who needs access to be the ownern and remove all other access. This should have the desired effect, allowing only that person to have access. If the person gets into a tight spot you as the administrator can alway retake ownership of the folder and access it as nessacary.

Bob Clinton my hero/God???????????
Not even on a blue moon!

Employers pay me to do a job and unless the contract says so (and none of mine ever have)
they don't own a blind skerrick of me or my personal information. They also have a duty to provide a safe working environment and protect my privacy - You can't go selling personal details about your employees without their permission and likewise you can't be careless with it either - My employers also know my employment history and what it entails (and usually want to draw on some of the skills)

Interesting assumption there that the people I have dealt with have been my victims??? Sorry to disappoint you but not one of them was forced, coerced or anything like that - they phoned, dropped in off the street etc cos they had some issues that they didn't have the skills to deal with and wanted to be pointed in the right direction or get some aid and assistance. Ever been in the position where someone with skills in an area you don't have (but need at the time) shares knowledge with you? Ever shared knowledge yourself? Same story, slightly different environment - kinda like a help desk only you are not helping people out with their computer hassles - I've been in the situation where help has been useful and if I can pass on something myself i am happy to. Take it how you want.

Cheers and thanks for the laugh about Clinton

Who is running your company anyway? It sounds like you're caught up in a catch 22! I personally would question the issue as well, let alone the integrity of the CEO. Are his records to be included in with the others' files also? Does this include violating the privacy act of employees personal info included on their job apps, along with their credit info and history? That's not for me, thanks! Count me out!