1

I am a low-level system administrator for a new college Learning Management System, or LMS.

(An LMS is the platform used by professors to post their syllabi, lecture notes, assignments, grades, announcements, etc.)

I do not have the authority to create new accounts, nor does anyone at our branch campus.

As new students are admitted into our school, we send account creation requests to the main campus.

The account creation process has a quirk. Let's say we send a request for ten new accounts, but two of these students have already taken courses at the main campus. We will get back a list of ten accounts that look like they have all been newly-created, each with an assigned password. The eight new accounts will perform as expected; however, the already-existing accounts will have a new password listed, but this password will not work (the system won't overwrite a password that has already been changed by the user).

Additionally, there is no way for us to check and see if the user already exists at the main campus, because we can see users only after they have been assigned to a course at our campus.

After new accounts are created, we send an email telling the user their login ID and password. We got tired of sending out erroneous information to those who already had accounts, so we began doing a test log-in before sending the information out, partly to seen which passwords worked and which did not, and partly to gauge the percentage of records that had erroneous information (i.e., bad passwords). In other words, we were trying to figure out: Is this just happening every once in a while? Or a lot? (It turns out roughly 20% or 30% of the records we were getting back had incorrect passwords listed.)

I realize there are many potential problems with the current system, and most of those problems are being worked on as we continue to iron things out. I'm not asking for suggested ways to improve the process. (I can think of several, including automating the process such that we no longer manually send emails with login information.)

Instead, I'd like to leverage the expertise of this community to ask: Is doing a test log-in with a newly-created student account some kind of a security faux pas? Would this be a no-no that should never be breached for any reason whatsoever? Or is it okay for a system admin to test a login before sending the information on to the user, particularly when it is known that there is a good chance the information will not be correct?

My staff is a customer-service organization with little-to-no formal training in information security. Also, once logged in successfully, we would immediately log out.

A recent debate has started on campus about whether we have been inadvertently committing a flagrant violation of security policy, or performing a justifiable quality assurance step by a system administrator. For the purposes of this question, we can assume "security policy" refers to industry best practices (not local written policies, which are being consulted even as I formulate this question).

  • 2
    Your college owns the account. As the sysadmin, you should have access to all of the information in their account, whether you've logged in as them or not. What you should not have is the password that they set once they get access to their account. You already know that the real faux-pas is the fact that there are passwords being passed around in plaintext, even if it is just their initial password. You're right to want to protect your users... Protect yourself as well by having deniability in case they accuse you of using their account to do something that they did. – Ghedipunk Jul 16 at 22:19
3

This is wrong. A sysadmin should never log in or even know the users password in the first place.

The issue is with the system, fix it. A good pitch to the management to get $$ for the fix is to say that this impacts your security very badly and give him a good example of what could happen if let's say a sysadmin goes rogue + how much it would cost them.

  • How does knowing the password create a major vulnerability for the org? The sys admins have access to all data in the system anyway. The risk here is for attribution problems. – schroeder Jul 18 at 7:26
  • Initial passwords for new accounts are often known by admins. security.stackexchange.com/questions/7045/… – schroeder Jul 18 at 7:35
  • It makes sense to know the initial password, which would be a temporary one, but you should never know the long-term passwords. This could potentially give a sysadmin possibility to impersonate a user and modify or delete company files with that. Ask any CFO or CEO if they are comfortable if a sysadmin knows their password :D. – Raimonds Liepiņš Jul 19 at 12:00
  • But that's not the situation in the question. Knowing the user-created password is a problem, but that's not exposed. – schroeder Jul 19 at 12:09
1

I'm not seeing the risk in this process. You test all accounts that have been created by this process, and either:

  • Truely new accounts successfully log in, and the only thing exposed is the data that was used to create the account. This info was the same as the data that the admins used in the account creation process. Nothing new has been exposed.
  • Existing accounts, with user-set passwords, do not let the admin login. The account is protected and nothing is exposed.

The risk here is with what the admin could do with a new account before it is passed to the user. The nature of the system (an LMS), means there is very little risk to anyone (org or user) in admins having this short window of access before it is used.

Is it a "no-no"? No. It certainly looks bad, but the risk assessment to the org or user is minimal and it meets a very real business need.

As others, and yourself, have pointed out, the problem is actually in the design of the system, but you say that you are addressing that. For this process, there is no risk to the CIA of any system, user, or data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.