5 ms·

> In pre-COVID-19 days, IT handling that kind of request would have required it to come in face-to-face. But since everyone's working from home, that's intracta

• throwawayboise 5y ago
  The one time I locked myself out hard at work and had to go "in person" for a password reset, I had to show ID even when the person who was resetting my password knew me by sight. And this was well over a decade ago. And in all but the smallest companies I've worked for, you needed a card swipe at the door (or an escort) to pass from public to internal areas. This is just really, really basic physical security stuff.
  • maccard 5y ago
    That might be true at some companies, but has not been my experience at 3 different companies. > And in all but the smallest companies I've worked for, you needed a card swipe at the door (or an escort) to pass from public to internal areas. And once you're past the barrier of those internal areas, you're unlikely to be questioned in all but the most strictly controlled places.
    • throwawayboise 5y ago
      In my case, everyone is supposed to be visibly wearing their company ID, on a necklace/lanyard or something like that. However even if challenged without one, "oh sorry, I left my ID at my desk" is likely to work. However everyone but brand-new employees is a least vaguely familiar to everyone else, so I'm not sure how easily a complete stranger would be able to move around.
• jdavis703 5y ago
  Most 2,000 person office buildings have security guards and doors/gates/turnstiles that won’t let just anyone waltz in.
  • maccard 5y ago
    Right, but once you get past that area nobody will question it. In the same way that someone who works for your company on slack pings you, you assume they work for your company.
    • notyourday 5y ago
      In the companies that I am familiar with the internal space has doors and every single door opens only with a badge
      • somebodythere 5y ago
        I think more than 50% of people would let you tailgate their badge
  • skinnymuch 5y ago
    A lot of people in this thread are acting like it’s super hard to get through or in. You can “social engineer” your way in. I did it accidentally once at a big hedge fund sort of company. I thought I was being escorted by my friend’s friend. But it was actually just some one familiar with them/their names not fully understanding what I was saying letting me thru the ~3? Times a badge scan was required. I wasn’t paying attention. Only when my friend got scared he would get in trouble did I realize what had happened.
• dysfunction 5y ago
  Previous company I worked at had a policy that you needed to include a photo of yourself with the current date written with any PW reset request, but of course that doesn't work as well at a 2000 person company as at a 100 person startup where IT knows everyone's face. Plus that's still vulnerable to googling photos of the employee you're impersonating and photoshopping a piece of paper with the date.
• adrianmonk 5y ago
  If you walk up to the IT desk, they should check your identity. (At least for security-sensitive things like password resets or locked accounts.) Most employees have a photo badge, so they could scan that and look up your records in the HR database. If you've lost your badge, they could ask your name and look that up in the HR database, which hopefully has a photo on file.
• antiterra 5y ago
  If you’re over 2000 employees, there’s little excuse for not requiring a badge scan to queue for all IT desk interactions. That scan should display name and photo to both desk workers and on a ‘now helping’ screen others can see. It’s not foolproof, but it’s incredibly difficult to prevent tailgating because people don’t want to start an incident by incorrectly challenging a coworker. I’ve heard of it somehow happening even with card turnstiles, double door scans and required photo confirm by lobby security.
• 05 5y ago
  Risk profiles and scale for Slack attacks vs in person soc eng are way different.