1

I have just taken control of a small corporate network with aprox 50 users. They have no firewall, no internet monitoring, thankfully they do have AD set up.... Anyway its just the way its grown up over the last 5 or so years with little-to-no proper IT intervention. it sort of works, but its time to sort it out.

So it has become clear that people are sharing user accounts, using other peoples' accounts, and certainly one team even has a list of their passwords on the desk, as they never change and sometimes need to "nip on" to someone else's account...

My recent background is in slightly bigger networks, say 500-1000 users, where strict IT policies are enforced, passwords are changed by force monthly, and everyone has their own account, passwords are NOT shared.

This needs to change - but i will likely get resistance from the management and teams. So, What reasons can i give to the management to justify the "crackdown" and enforcement of a stricter IT policy?

  • 2
    Money rules everything. Give them a list of what WILL happen(not what can) with their current habits and then give them a money value or a reputation value as a company of what they could stand to lose. I would lay out to them the things that you want to change, give the threats it poses if you don't and possible money lose if it occurs. Especially with smaller companies, one big breach and you could be finished for good. – nd510 Mar 15 '17 at 17:09
2

The reason behind not having shared passwords should be pretty simple. If you are able to record network activity and log Jane does X illegal activity on the network, well if everyone know's Jane's password, you can't attribute the activity to Jane. You'd be hard pressed to prove in court that she committed the act as everyone could have logged in as Jane and acted with her account. It's a legal issue mostly, which should be pretty easy to sell to management.

So if you know your manager's password you can log in as your manager, do whatever illegal activity you want, and now your manager could potentially be fired because someone above him thinks he was doing things he shouldn't have been doing and ultimately didn't actually do, but it sure looked like he did.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.