Neoseeker : News : Survey: 88% of system admins would take sensitive data if fired
Hardware Newsletter:
Email:

Latest News
Tue, Nov 18
Mon, Nov 17
Sun, Nov 16
Sat, Nov 15
Fri, Nov 14
Thu, Nov 13

send article hardware newsletter   article comments (2)

Survey: 88% of system admins would take sensitive data if fired
Kevin Spiess - Thursday, September 4th, 2008 | 11:25AM (PT)


Some steal stationary, some steal secret stuff

Survey: 88% of system admins would take sensitive data if fired Image 1

Remember that sysadmin who refused to relinquish control over much of the government's networks in San Francisco after he was canned? Well it seems that he isn't much of an aberration: a recent surveyed done by security company Cyber-Ark Software turned up some interesting results. A full 88% of IT administrators surveyed said that they would not hesitate to take sensitive information with them if they were fired for whatever reason. The survey questioned 300 people.

It seems like the majority of sysadmins just felt like it was sort of their property to take with them -- much the same way as Jim or Dwight from The Office (TV show) would take stationary or pens if they found themselves canned. Unfortunately, the survey did not question the administrators as to what they would do with the "CEO's passwords, the customer database, R & D plans, financial reports, M & A plans, and most importantly the company's list of privileged passwords," -- or whether they would steal them just because they could.   

The most prized information to retain were network passwords. Presumably these would be all changed by the new, incoming system administrators of course, but in the interim, a devious and disgruntled sysadmin could wreck all sorts of havoc from home with these passwords. Or, on the flip side of the coin, if the sysadmin was unfairly fired for some hardly significant reason, the admin could use the passwords for leveraging a good reference, or a better severance package.

"Most company directors are blissfully unaware of the administrative or privileged passwords that their IT staff has access to which allows them to see everything that is going on within the company. These privileged identities, which lie on hundreds of servers and applications, very rarely get changed as it's often considered too much hassle," said Udi Mokady, of Cyber-Ark Software.

Another interesting tidbit turned up by the survey was that a full one third of network geek-lords surveyed admitted to leaving passwords around the office on Post-It notes and pieces of paper. This is alarming of course, because study after study have shown Post-It notes to be notoriously dangerous and frighteningly insecure. 


Source: Cyber Ark

Section: Networking

  Related Stories

back to news    comments or corrections
- This news story is archived and is closed to comments now -

Comments:

September 4th, 2008 1:30PM(PT)
ybf
It's astonishing to me that network passwords aren't automatically generated daily and accessed in a password database using a SecureID type of system. Then it's a matter of blocking that sysadmin's login name from using one resource, just before you deliver the pink slip. Plus, everyone else in most companies is required to change their passwords periodically and follow arcane password construction rules, but nobody else has the kind of power to cause damage that fired sysadmins do. Root should be the one with the strongest restrictions and shortest password timeouts. I guess "do as I say, not as I do" is still alive in the server room.
September 4th, 2008 4:37PM(PT)
kspiess
I'm really surprised that most places (apparently) don't change all the passwords once a sysadmin leaves.

- This news story is archived and is closed to new comments now -

  RSS Feeds

Latest Comments
Most Comments

Latest Net Reviews:
Latest Inhouse:


Compare Prices

Motherboards
 Abit
 ASUS
 Gigabyte
 Intel
 iWill
 Shuttle
 Soyo
 Super Micro
 Tyan
 More...

Processors
 AMD
 Intel
 More...

Memory
 SDRAM
 RDRAM
 DDRAM
 More...

Video Cards
 ATI
 Visiontek
 PNY
 3Dfx
 More...

search for lowest prices
(0.0179/mc/aeon)