Reply to: Agency asking for laptop log-in details following termination

[LondonManc]

Personal laptop on site with mobile acting as wifi hotspot. Simple.

[Boney M]

Don't clients Security policies cover logging in to unauthorised remote stuff or are they so badly written it nor ally won't apply?

I would have thought logging on to something which isnt allowed by the security policy is much worse than having some personal stuff on a works PC?

I log on through my own CAG so no how are they going to prevent that and it doesnt touch their system at all

[northernladuk]

FTFY

But enforcing it would mean you getting caught and walked no?

[clearedforlanding]

Don't clients Security policies cover logging in to unauthorised remote stuff or are they so badly enforced it nor ally won't apply?

FTFY

[northernladuk]

I never put any personal stuff on any corporate machines, I merely logon to my citrix server at home and do what I need that way

Don't clients Security policies cover logging in to unauthorised remote stuff or are they so badly written it nor ally won't apply?

I would have thought logging on to something which isnt allowed by the security policy is much worse than having some personal stuff on a works PC?

[Boney M]

I never put any personal stuff on any corporate machines, I merely logon to my citrix server at home and do what I need that way

[seanraaron]

Cool story bro... Got any contractor ones?

Not yet.

[MrMarkyMark]

I had a new hire set an ssh key passphrase that seemed to be an entire sentence and then forget it within a minute or two, after I had gone through a laborious manual process to distribute it. He then created a new one which I suggested he record in some kind of password safe. I think he forgot that one within a day or two? After that I didn't bother distributing his key until he requested access to a machine. Needless to say his probation was extended.

[northernladuk]

I had a new hire set an ssh key passphrase that seemed to be an entire sentence and then forget it within a minute or two, after I had gone through a laborious manual process to distribute it. He then created a new one which I suggested he record in some kind of password safe. I think he forgot that one within a day or two? After that I didn't bother distributing his key until he requested access to a machine. Needless to say his probation was extended.

Cool story bro... Got any contractor ones?

[seanraaron]

The password might well be something unmemorable like ApxR5%j4x and held e.g. in some password container app on a phone.

I had a new hire set an ssh key passphrase that seemed to be an entire sentence and then forget it within a minute or two, after I had gone through a laborious manual process to distribute it. He then created a new one which I suggested he record in some kind of password safe. I think he forgot that one within a day or two? After that I didn't bother distributing his key until he requested access to a machine. Needless to say his probation was extended.

[SueEllen]

FT

I would omit the would be a breach of the client's security policy and, unless he has a copy of the client's security policy in hand and has signed it and can quote the specific clause. For all we know recovering password for access to laptops that may contain their IP may be policy.

Less equals more in this scenario. If there is a reply from the client contesting this, then a copy of the policy that he signed can be requested and the appropriate clause highlighted by the client.

In my last few contracts I was sent the clients' security policy before getting on site.

[clearedforlanding]

Fine then an email to the agent pointing out he can't give the details as it goes against standard industry security practice is in order.

FT

I would omit the would be a breach of the client's security policy and, unless he has a copy of the client's security policy in hand and has signed it and can quote the specific clause. For all we know recovering password for access to laptops that may contain their IP may be policy.

Less equals more in this scenario. If there is a reply from the client contesting this, then a copy of the policy that he signed can be requested and the appropriate clause highlighted by the client. -I doubt the matter would go any further.

[SueEllen]

OP didn´t. He ran for the hills after a couple of weeks. OPSEC is OPSEC, common sense doesn´t come in to it. I would only recommend to responding to requests for AAA that comply with best industry practice and have a paper trail.

Fine then an email to the agent pointing out he can't give the details as it would be a breach of the client's security policy and goes against standard industry security practice is in order.

[MrMarkyMark]

FTFY

OP didn´t. He ran for the hills, like the biggest bed wetter in the world, after a couple of weeks. OPSEC is OPSEC, common sense doesn´t come in to it. I would only recommend to responding to requests for AAA that comply with best industry practice and have a paper trail.

[clearedforlanding]

Bit of common sense is needed here.

If the agent is asking for it you don't give it to them. However you should have got on well enough with the client so you can phone them up and give them the password. After you have done that you just contact the agent and state you have already given it to the client pointing out it's a breach of the client's security to give it to them.

OP didn´t. He ran for the hills after a couple of weeks. OPSEC is OPSEC, common sense doesn´t come in to it. I would only recommend to responding to requests for AAA that comply with best industry practice and have a paper trail.