I hate it when they post articles like this and don't post the questions.  I haven't checked, but I'm pretty sure I still have at least one privileged password for each of my last two jobs, not because I deliberately stole them, but just because there were so many, and they probably haven't changed them all.  Two jobs ago I left a list of passwords that needed to be changed when I left that was 20-30 long, and a few of those had administrator access to basically every computer on the network.  I don't know if I count by their standards.

I'll admit that I've stolen software license keys before, but I don't know if that counts, either.

One lesson companies never seem to learn, though, is that your security should rely on trusting people to just do the right thing as little as possible.  Especially where I work now and a huge amount of the company's worth is stored digitally, I can't figure out why people continually resist even the most basic security measures (I don't mean the company as a whole, I'm talking about individual employees).

That being said, I've known an awful lot of IT people who were crooks in one way or another.

What I hate is when you try to implement procedures that restrict access to what is needed and you get pushback from other IT people, like you're accusing them of being untrustworthy.  How the hell should I know which people can handle the responsibility?  Good processes mean you never have to.  Besides, smart people know that having access to things you don't need is just putting yourself in the suspect list for no reason when something goes wrong.


I bet the results of their survey change a lot depending on the economy, too.  I've seen people do some crazy shit when they think the company's going to screw them over by laying them off.  I worked at a company in one of my first IT jobs that laid off almost half of its 150,000 employees in the 8 months I was there.  People would come in to work and call me because their computer wasn't working, and it was because someone stole the RAM.  People would call because their phone didn't work, and it was because they stole the digital phone from across the hall.  It was a frigging free-for-all.

I just played the password game in prep for an audit - changed every fucking password in the house.  Naturally this week was pure hell - fucking Microsoft and their embedded passwords. 

I have a nifty script that enumerates the services and assigns random passwords to service accounts, but those neat little "Enterprise" apps from MS fuck up the works. Basically end up rebooting every server in the house just to get shit to work again.  Of course this must be done every 90 days.

I don't know about out-right theft, but I do know that most IT guys in small shops end up with really nice home computing systems; like my Dell 2010 for example    =)

choad wrote:

You're taking lessons from Simon again, is that it?

Interesting.