4 ms·

I had a client that didn't like to use passwords on their server because he could never remember them when he wanted to check something. His security solution w

I had a client that didn't like to use passwords on their server because he could never remember them when he wanted to check something. His security solution was to put the server in a steel locker with 1 hole just large enough to pass a cord from a power strip and a CAT5 cable out of the side. Then lock the locker so no one had physical access to the server. He did all this on his own on a Friday and then he left the CRT on all weekend. I got a call on Monday letting me know that "my" server had failed and I needed to get out there immediately. And of course, when I got there he was gone with the only key to the locker.

cwkoss 6y ago
I wonder how much situations like this contribute to the high frequency of lockpicking being a hobby in IT/sec circles.
- hinkley 6y ago
  We were going to move a server one evening and we told the head of IT ahead of time we needed to move it at 6. He agrees. At 5:45 we roll into the server room area and he has gone home for the evening. Server room is locked. Someone as a Hail Mary asks building security, and they surprise us by saying of course we have keys. So they come in and try the doors (the server room had been expanded to fill several offices, so there were 3 doors). No luck with any of them. Which upset the security person because they were supposed to have keys. So security wanders off before we start trying to jimmy the locks, and it turns out that the middle door accepts Mastercard. It was never mentioned again and the IT dude never asked (which he should have, really). I don't know that I'd play it the same today. Back doors are put in or tolerated primarily because of fear of, or the reality that, someone isn't doing their job or some group is making a power grab (or typically, both). It costs political capital to call someone out on that but the alternative is to have people lying (even by omission) about known security issues with the system or facilities. Personally, I'd rather have a couple people who have credentials or keys they are sworn 'never to use', except in extraordinary circumstances.

cwkoss 6y ago

I wonder how much situations like this contribute to the high frequency of lockpicking being a hobby in IT/sec circles.

hinkley 6y ago
We were going to move a server one evening and we told the head of IT ahead of time we needed to move it at 6. He agrees. At 5:45 we roll into the server room area and he has gone home for the evening. Server room is locked. Someone as a Hail Mary asks building security, and they surprise us by saying of course we have keys. So they come in and try the doors (the server room had been expanded to fill several offices, so there were 3 doors). No luck with any of them. Which upset the security person because they were supposed to have keys. So security wanders off before we start trying to jimmy the locks, and it turns out that the middle door accepts Mastercard. It was never mentioned again and the IT dude never asked (which he should have, really). I don't know that I'd play it the same today. Back doors are put in or tolerated primarily because of fear of, or the reality that, someone isn't doing their job or some group is making a power grab (or typically, both). It costs political capital to call someone out on that but the alternative is to have people lying (even by omission) about known security issues with the system or facilities. Personally, I'd rather have a couple people who have credentials or keys they are sworn 'never to use', except in extraordinary circumstances.