Agency asking for laptop log-in details following termination

[Yonmons]

what kind of company cant access one of its corporate laptops after an employee/contractor has left and been using it. I wouldnt be giving my password to anyone.

[NotAllThere]

Not really, I always set the password on any work machines back to "password" and leave a post-it on the screen to say what I've done.

It seems hard to beliwve that you've forgotten your logon after 5 days too...

Boo

The password might well be something unmemorable like ApxR5%j4x and held e.g. in some password container app on a phone.

[clearedforlanding]

How are you expected to give them the password?

Can you validate with 100% certainty the person requesting the credentials is not an imposter or an internal security risk themselves?

Do you have confirmation in writing that this has been signed off at the top of the food chain & by HR? Do you have this on letterhead paper delivered by secure courier and in a sealed document stamped with the company seal?

If so then sure, go for it. If not consider a company that does not have a policy that allows them to access to an asset laptop once you have left, does not have an adequate security policy and you may take the heat at a later date.

[SueEllen]

How are you expected to give them the password?

Can you validate with 100% certainty the person requesting the credentials is not an imposter or an internal security risk themselves?

Do you have confirmation in writing that this has been signed off at the top of the food chain & by HR? Do you have this on letterhead paper delivered by secure courier and in a sealed document stamped with the company seal?

If so then sure, go for it. If not consider a company that does not have a policy that allows them to access to an asset laptop once you have left, does not have an adequate security policy and you may take the heat at a later date.

Bit of common sense is needed here.

If the agent is asking for it you don't give it to them. However you should have got on well enough with the client so you can phone them up and give them the password. After you have done that you just contact the agent and state you have already given it to the client pointing out it's a breach of the client's security to give it to them.

[LondonManc]

Surely if Windows AD is in use, they could simply have a sysadmin reset your password to whatever they want? I've seen that done in the past where contractors have departed with a less than adequate handover (e.g. give me your pass then go forth and multiply).

[clearedforlanding]

Bit of common sense is needed here.

If the agent is asking for it you don't give it to them. However you should have got on well enough with the client so you can phone them up and give them the password. After you have done that you just contact the agent and state you have already given it to the client pointing out it's a breach of the client's security to give it to them.

OP didn´t. He ran for the hills after a couple of weeks. OPSEC is OPSEC, common sense doesn´t come in to it. I would only recommend to responding to requests for AAA that comply with best industry practice and have a paper trail.

[MrMarkyMark]

FTFY

OP didn´t. He ran for the hills, like the biggest bed wetter in the world, after a couple of weeks. OPSEC is OPSEC, common sense doesn´t come in to it. I would only recommend to responding to requests for AAA that comply with best industry practice and have a paper trail.

[SueEllen]

OP didn´t. He ran for the hills after a couple of weeks. OPSEC is OPSEC, common sense doesn´t come in to it. I would only recommend to responding to requests for AAA that comply with best industry practice and have a paper trail.

Fine then an email to the agent pointing out he can't give the details as it would be a breach of the client's security policy and goes against standard industry security practice is in order.

[clearedforlanding]

Fine then an email to the agent pointing out he can't give the details as it goes against standard industry security practice is in order.

FT

I would omit the would be a breach of the client's security policy and, unless he has a copy of the client's security policy in hand and has signed it and can quote the specific clause. For all we know recovering password for access to laptops that may contain their IP may be policy.

Less equals more in this scenario. If there is a reply from the client contesting this, then a copy of the policy that he signed can be requested and the appropriate clause highlighted by the client. -I doubt the matter would go any further.

[SueEllen]

FT

I would omit the would be a breach of the client's security policy and, unless he has a copy of the client's security policy in hand and has signed it and can quote the specific clause. For all we know recovering password for access to laptops that may contain their IP may be policy.

Less equals more in this scenario. If there is a reply from the client contesting this, then a copy of the policy that he signed can be requested and the appropriate clause highlighted by the client.

In my last few contracts I was sent the clients' security policy before getting on site.