5

I work for a medium sized company of around 100 people or so - and I am employed to be Head of IT responsible for backups, security, sorting out technical issues, among other things etc etc.

However I have had my Office365 Exchange admin rights and backup access removed by the company directors on grounds that I "could access sensitive personnel information". (Something I have never or would not do)

I feel like this means they do not trust me, and that I cannot do my job properly (Like setting up new users on backups, or setting up Emails) because of it and I have to go via a director.

This is also the reason why they will not have a domain network as it means I would have access to everything and I would be the only one who knows how to sort a problem out if things went wrong. Instead they have local standalone machines in a workgroup which everyone has their own PC as a local administrator which in my head is a horrible security nightmare as I cannot do any overall management for updates, security, virus checking, application installation, checking for rogue devices on the network etc etc.

Do you guys think this is a reasonable thing to do?

  • 2
    Whoa whoa whoa, having standalone machines on a workgroup as a business solution? That seems to fly in the face of role based access controls. That basically means "if it's on your PC, you own it and can decide who else owns it too", regardless if that leads to over-sharing or not. Depending on what field your business is in, I'd check with legal to see if there's any possible legal ramifications for improper data access/sharing between employees. – Mr. Llama Jul 24 '18 at 15:51
  • Check out your roles, if the environment need proper policies and guidelines, you should start speak your way and propose changes. The mentioned password access is just little part of the bad corporate security roles & policy guidelines – mootmoot Jul 24 '18 at 16:07
  • Their other argument is - if it ain't broke and nothing untoward has ever happened - why complicate it further with a very expensive domain setup - where more of my time will be dedicated to looking after that... – Jeff Jul 24 '18 at 16:17
  • 2
    nothing untoward has ever happened, until a malware happens and wipes the company out of the world... – ThoriumBR Jul 24 '18 at 17:47
  • If someone(s) on the board are stealing from the company or having an affair (and don't want their IT lead to extort them later), these are reasonable precautions to protect matters of such sensitivity. – Ivan Jul 25 '18 at 20:02
6

This seems borderline insane.
There's two major issues that seem to be overlooked by company directors:

  • Business continuity planning/disaster recovery
  • Role based access controls

Without somebody having admin rights to the Exchange server, how are backups even supposed to take place? Is every user responsible for making their own email backups and keeping them safe in case they need to be restored? For that matter, given that there's no domain network, how are workstations supposed to be centrally backed up/restored in case of failure? Each machine becomes a single point of failure and any critical documents on them could be lost forever if something goes wrong.

Secondly, putting every workstation in a homegroup is asking for improper data access. With each user being the sole administrator of their workstation, they essentially own whatever data resides on it. There would be nothing stopping them from giving access to other employees, regardless if those employees are supposed to have access or not. This could have huge legal ramifications depending on the type of business your company conducts and may be worth bringing up to the legal department.

Lastly, with each user being the master of their own workstations, keeping each network at a minimum security level will basically be impossible. Any antivirus or data loss prevention software could simply be disabled or removed by the user, not to mention all the potentially malicious software they may end up installing on their own. If any machine ends up compromised, it would likely be compromised with full administrator access on a network with no standardized access controls and no guaranteed backups or recovery options. Basically, a theft/damage/ransom nightmare (or paradise, depending on perspective).

3

Do you guys think this is a reasonable thing to do?

No, not if there isn't something else going on that either you aren't aware of or are leaving out of the description.

An example reason that a company may severely clamp down on access to communications like email is if they are in discussions about buying/selling to/merging with another company. Tight control of this information prior to a public announcement may prevent a number of significant problems.

I am employed to be Head of IT responsible for backups, security, sorting out technical issues, among other things

Clearly you are not "Head of IT" and I don't know if that is your actual position or a title you give yourself as part of a limited IT staff (possibly a staff of one). Clearly the director(s) making the decisions is the actual head of IT. If that is how your job description reads, then you need them to rewrite your job description.

I personally would not continue to work at a place where a job description reads like that and I don't have the means to do my job. I would have concerns that I would be the scapegoat if/when issues result. "It says in your job description you are responsible for xxx, so the failure is your fault."

I have had my Office365 Exchange admin rights and backup access removed by the company directors on grounds that I "could access sensitive personnel information"

Clearly with that access you could access sensitive information. That is always a potential concern for hiring IT staff, but for IT staff to do their job they need access. There has to be a level of trust in the IT staff commensurate to their job expectations as well as sufficient protection for the company. For example, I myself have often found that I get the same (or more) training on privacy issues than medical professionals when working in such an environment. In other cases, an NDA and/or background check was required.

However, I am curious about the "I have had...access removed by the company directors" statement. This sounds like you had access and it was taken away. This is not something that would normally be done if you hadn't done something to warrant such a change. If you haven't, refer to a few paragraphs above in my answer starting at "I personally would not continue to work..."

I feel like this means they do not trust me, and that I cannot do my job properly

If the job responsibilities you laid out are accurate and/or something else isn't going on, no they don't and no you can't.

However, perhaps they view your job responsibilities a bit differently and as such do not believe you need the access you describe. If this is the case, then be thankful. If I don't need access to perform my job, I would rather not have it. It is difficult to blame someone for things like leaked personal information if they don't have access to it in the first place.

This is also the reason why they will not have a domain network as it means I would have access to everything and I would be the only one who knows how to sort a problem out if things went wrong.

Ah, um, wow? What can I say to that? So badly reasoned, I am hoping that is your frustrated translation of their stance.

A properly maintained and administered domain can significantly decrease the risk of something going wrong. That includes proper documentation and training of a secondary or backup admin (even if their primary job function is not IT...like the aforementioned director perhaps?).

Especially since that documentation should provide for disaster planning and for a smallish company I would recommend that include contact information for a third party support resource (local IT service company) - for when you are on vacation and your secondary admin is sick/injured/dead.

Instead they have local standalone machines in a workgroup which everyone has their own PC as a local administrator which in my head is a horrible security nightmare as I cannot do any overall management for updates, security, virus checking, application installation, checking for rogue devices on the network

You could have simply ended this sentence after "nightmare" and removed "in my head." Again, it sounds like you have do not have control of IT in any sense, circling back to you are not the "Head of IT" for the company. If you were the "Head of IT" then you would be able to make decisions on how IT operates for the company.

Your network is only as secure as the weakest link and when each individual is responsible for their own workstation's maintenance and security, there is no standard for maintaining a minimum level of security.

1

The point is here:

I feel like this means they do not trust me, and that I cannot do my job properly

I had worked both as a sysadmin and as a non IT manager, and on both places were scared of what a sysadmin could see and do. The most common behaviour is to just ignore that point: highly confidential data are just left non encrypted on servers, with strict access rights - except that any member of the IT staff can also access it...

You are just facing the opposite behaviour, where the highest managers considere that you are not authorized to access their confidential data. It can make sense but it also means that you cannot protect and administer their machines.

If they have conducted a true risk analysis, and after that considere that the higher risk for data leak is inside the organization, then a network of standalone machines where everyone is a local admin could make sense. The IT department in then only in charge of peripheral security (proxy and firewalls), general support including storage and backup for low sensibility data, and advices.

In a real world, I cannot imagine on organization where all the machines should run standalone. The pre-requisites for that are highly sensitive data, and above basic knowledge on IT administration and security. From my experience, only the highest managers should need to be protected from the IT staff.

My opinion is that the correct way to handle the question is (as usual when it comes to security) a risk analysis. If the boss says that leakage of his data by the IT staff is a risk you must take it into account. And as the IT specialist, you must also warn him of the other risks involved by machines where security patches are not installed, and by machines where the owner is a local admin. Once this is done, the goal is to determine what threats should be considered and how to best mitigate the non acceptable risks. Everybody does it nowadays is not efficient to convince an executive manager. Doing that exposes the organization to that threat with those possible outcomes generaly speaks louder.

After all, the general responsability it theirs. You can only make clear what you could do, and what you will no be liable to, if somebody else has the admin privileges.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.