3 ms·
Some manager asks IT multiple times over the course of a few weeks to create an account for a contractor, then give them permissions to access production type m
by daemin 8y ago
Some manager asks IT multiple times over the course of a few weeks to create an account for a contractor, then give them permissions to access production type machines.
Or a contractor that was fired had their credentials appropriated by this manager, perhaps by that manager removing them from a "delete these accounts" list.
Those are a couple of mundane ways of getting a false username to a production machine. This is even easier when there is a lot of flux at the company with many people coming and going, a lot of account management happening etc.
It could have been that the accounts were local to specific machines and not managed by the company as a whole.
- alxlaz 8y ago> Some manager asks IT multiple times over the course of a few weeks to create an account for a contractor, then give them permissions to access production type machines. And -- keeping in mind that production type machines operate machinery that can kill -- this sounds okay to you? Not to mention this: > Or a contractor that was fired had their credentials appropriated by this manager, perhaps by that manager removing them from a "delete these accounts" list. ...keeping in mind that production type machines operate machinery that can kill, does it sound OK to you that anyone can get access to an account that they don't own and control it? This particular case would be enough to have PCI certification come into question (if not for it to be revoked), and that's just about money, not life-and-death stuff.
- daemin 8y agoSomeone has to be responsible for managing people and organising access to the appropriate machines for them to do their job, if it isn't their manager then who is?
- alxlaz 8y agoYou can manage people and organize access without actually having the ability to gain access to their credentials. In fact, that's how it's supposed to work in safety-critical environments.
- softawre 8y agoThis is how it works in normal software companies too. I never see the credentials for my employees.
- daemin 8y agoMy point is, as a manager one can request that their subordinates get credentials to access systems. Therefore as a manager you could create a fictitious person (or use one that's recently left the company), and have them be given credentials to access those systems. Then you could use that fictional identity to do whatever nefarious things you want to do. Then again it could be just as simple to create an alternate fictitious identity without going through IT but just by accessing the systems you have permission to access anyway.
- alxlaz 8y agoIn a normal company, you could absolutely not create a fictitious account that way, or re-use the credentials of someone who just left. But more important, there is a very, very long way from having created a fictitious person to being able to push stuff to production in their name. The former restriction is maybe difficult enough to efficiently implement in an organization that it's excusable (we have a scheme for it at $work, but it unfortunately means that sometimes people show up at work and the paperwork isn't ready yet and some of the accounts they need aren't yet ready). The latter, on the other hand, is security 101 and not implementing it on the production floor is just irresponsible. I really hope it's not what happened.
- daemin 8y agoSo what are the odds then that they created a new user account on some local machine and used that to make the changes?
- alxlaz 8y agoIf we're talking about changes to the software that's used to manufactures vehicles that are driving on public roads, I sure as hell hope the odds are zero.