Something that frequently confuses many of our clients is the concept of a user versus that of a computer. Now, I’m not saying that they can’t tell the difference by looking at the two, (imagine the HR nightmares that would result), but functionally speaking, it’s not at all uncommon for us to encounter locations where Internet content filtering is done by computer, certain computers are used to run certain tasks and, worst of all, everyone uses the same username and password on a computer. Here’s why these are bad.
Mistake #1: Filtering website access by computer as opposed to by user.
This should really be a no-brainer. If Alice is banned by policy from surfing Facebook, but Alice’s computer is blocked, what is Alice to do? Simple! Alice will walk over to Bob’s computer and access Facebook there. “Problem” solved.
Mistake #2:”This computer runs XYZ process.”
In cases where a piece of hardware, e.g., a CNC machine, scanner, 3D printer, point of sale system, etc., physically needs to connect to some other device to manage it, of course that computer is the one that runs the process. However, when it comes to running an end-of-day report, processing payroll, checking your email, or other functions that do not require physical connectivity, these functions can often be run from any number of systems, and need not be tied to a single PC.
Mistake #3: “Everyone uses Charlie’s computer to do X (and logs in as Charlie to do it).”
Sharing a computer is not always a bad thing. As in the previous mistake examples, sometimes there is no other option if, for instance, you have a dedicated piece of hardware tied to a single PC. But there’s no reason that everyone should use the same username and password to do so, especially if it’s a user’s username and password. In rare circumstances, it makes sense to assign a shared user account to do a single function, such as run a report, operate a machine, etc., as long as it has been stripped of all non-essential privileges to ensure maximum security and avoid potential for (completely anonymous) abuse. In most cases, when Alice has access to Bob’s password, Alice can completely impersonate Bob, meaning she can read his email, send email as him, create, delete, and modify documents as him, etc. If Alice decides to leave the company and give them a parting kick in the teeth, what better than to make it look like Bob did the kicking?
Do you need to review your security policy to ensure you’re not making these critical mistakes?
Comments are closed.