Sys-Admins Reading the Bosses Mail? 398
PetManimal writes "Computerworld has an article about IT staff who have access to corner-office email. Systems administrators, database administrators, storage administrators and higher level IT super users are the types who may access sensitive executive information; one source quoted in the article says that in a company with 1,500 employees, there might typically be five to 10 administrators who have this access. As for how many abuse these priviledges, it's hard to tell, but rogue admins out for workplace revenge or personal gain can wreak havoc: '... Experts agree that the severity of these occurrences generally makes them more harmful than external attacks. One of the biggest obstacles to eliminating unauthorized access is determining how many people have it. Access lists are particularly difficult to formulate in both mature companies, where the number and power of administrators have expanded over periods of years, and small companies, where rapid growth leads to undocumented tangles of administrators who are able to maintain their access because nobody has time to assess their status.'"
apparently they never read BOFH! (Score:5, Funny)
Clearance Control (Score:5, Insightful)
Re:Clearance Control (Score:5, Insightful)
Re:Clearance Control (Score:5, Interesting)
Re:Clearance Control (Score:5, Funny)
That's one good example. Another is secretaries. Everything confidential seems to go through them in a small business and they always seem to need access to all the sensitive areas of the network.
Incidentally, I run the network at my current employers. Shortly after starting, I restructured all the groups to make it more secure. I then matter of factly told them that I'd removed my access to certain areas that I didn't have the right to access. On occasion, I've added myself back on to accomplish certain things for them. They always find that hugely amusing.
Re: (Score:3, Insightful)
We do this in a lot of places too, and I think there are perfectly good reasons for it, including security. (eg. If my account ever gets hacked, someone probably still needs to know a much more secure password if they want to give the account more access.) Another is just plain robustness. It's harder for me to accidentally break things when I don't have access to them.
At least as importantly, though, I think it helps the users actually trust us more easily. Most of our users realise that we don't auto
Re: (Score:3, Interesting)
Janitors have the keys to the whole building, but none of the file cabinets.
And, yes, the analogy is a good one. Read the rest of this thread; do the Dilbertian attitudes presented make you feel warm and fuzzy about the loyalty and trustworthiness of the avarage sysadmin? Sysadmins should have enough access to maintain the systems, but not enough to modify their own personnel files or read their boss' mail (at least not without leaving a trail).
Achieving this is not rocket science with a modern system.
Re:Clearance Control (Score:5, Insightful)
The question isn't whether to trust, but under what conditions? Accountants and bookeepers often have checks, balances, licenses and bonding. CxOs have major positions of repsonsibilty with the salaries to match, and now they have Sarbanes-Oxley too. Physical security folks are often bonded, polygraphed, drug tested, etc.
So which of these are most applicable to IT? Do we have checks, balances, licensing, bonding, major positions of responsibility with the salaries to match? Do we have polygraphs or drug tests? Do we have laws like SOX that put us in the hot seat if things go wrong?
I'm not sugesting we should do any particular one of these things, but as IT continues to mature, and IT is seen, as it should be, as a single point of failure that could cause damage up to, and including, the complete collapse of the company, we're going to need to proffesionalize our practices to the point much greater than the blind faith that often exists today.
TW
(note: I know IT has a major role in SOX compliance, but we're not held responsible unless the company in question builds that into the system. Many companies aren't, at least not to the extent they should. If SOX causes more shops to know exactly who has access to email, and exactly how to go about making sure they're responsible and holding them accountable then, well, problem solved. I personally don't think SOX alone is enough.)
Re:Clearance Control (Score:5, Insightful)
On your desktop machine? Who keeps your desktop machine?
On your USB? a) Are you violating a policy for using a USB device? and b) When then USB is plugged-in, it's part of the machine (see above)
If it's passphrase encrypted, are you 100% sure that there isn't a software keylogger on your machine?
Trust me, you can't hide anything from competent sysadmins.
The only way to make sure you control your machine is to install it, secure it, and manage it yourself, but then you've become the sysadmin.
And it may very well be that the company won't allow anyone but an experienced and trusted sysadmin to plug such a machine into the corporate network (for good reason I might add).
So you might as well get used to the idea that sysadmins have access to everything on the network.
[puts on sysadmin hat]
Ad that is how it should be anyway if you want the network to even start down the path of better security.
Re: (Score:3, Interesting)
But to be adopted, any such solution would have to protect the bosses' email from peons while still allowing convenient access to the peons' email by the bosses. Companies don't want email to be private, what they want is to control who can read whose mail. And of course the government is above all of them, making requirements that even the bosses' emails are archived and subject to subponea later on. In fact, President Bush stated [washingtonpost.com] in a
Re:Clearance Control (Score:5, Interesting)
Frankly, I say it's a nightmare for a small company when a big boss reads shit like this, freaks out, and all of a sudden you have to spend the next week trying to implement some goofy policy that will either be totally ignored, or tossed aside when it becomes a hassle. For larger companies, yes, internal security is no laughing matter. For small companies, when there's one, maybe 2 admins running the show, it's a wasted expense. They don't need intricate security policies. They need nothing more than, "Okay, I can access everything, everyone else can access their own shit. Done."
Re: (Score:3, Funny)
Re: (Score:3, Funny)
It's like you read my mind. Freaky.
Re:Clearance Control (Score:5, Insightful)
And this is what is really wrong with IT now. In 100-200 years maybe when the industry starts to get alittle mature things will change, but currently the one or two computer guys have access to everything school of thought is really what's wrong with the entire industry. I'll consider this industry to be growing up when any small business could hire/fire/transfer admins with complete confidence that the new guy has complete access and the old guy has zero access without carrying home backups or enough info to successfully compete with the company. We just aren't there, yet. I know that I'm trust worthy, but I wouldn't trust any other IT person. I wouldn't trust Bill Gates or Linus to be left with ulitmate unchecked power over all my machines. Why would I want a setup where just 1 guy may or may not have complete control/access to the small network? Of course you need to define "small business." If you are talking about 10 networked computers and one temp. computer contracter guy that comes in to set things up or do windows up dates every 3 months or so, then your reasoning makes sense, but is still off. That computer guy no matter how trusted shouldn't have complete control over the network. What happens when that trusted computer guy is killed by a drunk driver, and then you have to hire a new guy?
Re:Clearance Control (Score:5, Interesting)
Many small businesses have several key player that would severly hurt the company if they left. I was working at a small database company many moons ago, and was offers a consulting gig in a far off state at twice my current salary and I jumped at the chance. I had no clue that there was a million dollar contract riding on the project I was working on. Once the customer heard I was leaving, the contract evaporated. If they had only let me know that what I was doing really mattered, I might have stayed. (at a higher rate)
Re:Clearance Control (Score:5, Interesting)
BWAHAHAHAHAHAHAH! F*CKERZ!
Re: (Score:3, Insightful)
Here, there's also an "if sysadmins get run over" domain admin account detailed in an envelope in the company safe (with appropriate precautions to make tampering evident).
Use of that password and account will light up every sysadmins pager / mobile and is logged as critical in all monitoring kit. So there's the means to ensure business continuity, but a massive lart ready for anyone who abuses their access to that envelope.
You still need to read the network docs and kno
Re: (Score:3, Insightful)
You simply cannot run a network effectively
Flavor of the week. (Score:3, Insightful)
Think about it. A group of highly paid MBAs sit in a room and come up with an IT solution you are supposed to implement.
It really doesn't matter whether or not their solution is workable. You MUST embrace it.
If you do not embrace it, you will always be remembered as the "difficult one".
And really, the stupider the idea is, the faster it will go away and be forgotten. It is kind of like evolution, good ideas li
Re:Trained Professionals (Score:4, Informative)
Funny. The day after email was invented the snooping began. I've seen it since the 70s. I knew a sysadmin of a well known california site that read EVERYTHING; absolutely nothing is safe.
If you don't want somebody else to see it, never type it.
I use the phone a lot.
Re: (Score:3, Insightful)
I don't suppose you use voice-over-IP phones? I bet it would be trivial to set up auto-transcript on our CEO's phone IP...
Re: (Score:3, Interesting)
Re: (Score:2, Funny)
Well there was, until you went and told everyone!
Re:Clearance Control (Score:5, Insightful)
You can't back security into an organisation. Either the individuals are prepared to put up with the extra work it needs, or they aren't. Without some effort from everyone, your level of security drops to that of the weakest link (usually the boss)
Re: (Score:3, Insightful)
Re:Clearance Control (Score:5, Interesting)
Re: (Score:3, Insightful)
If the company is huge, it's hard to audit all the systems to ensure no backdoors - especially that local admins have years of experience with said systems, often with custom modifications auditors will have no idea about. If the company is small, it's very expensive to employ a reliable external contractor who will implement security properly (and won't side with the admin instead of the boss, "overlooking" some backdoor). It may be easier in a new company where a system is created f
Re: (Score:2, Interesting)
Passing on encryption (Score:2, Insightful)
Bah old news... (Score:5, Funny)
Gotta go, he's sending an email now about outsourcing the IT department!
Re: (Score:2)
Funny but... (Score:3, Insightful)
Re:Funny but... (Score:5, Interesting)
Reading the parent's post made me recall this footnote from my economics classes. It's a theory that when you pay your employees well(i.e, better than the average competitor), you'll find advantages in that employee's performance. If you're in a good job and know you're being treated like you're a good employee, the theory is that this serves to discourage you from being a bad employee since you're risking the loss of a good thing.
There's other reasons involved in this theory too though. If your compensation is that of a good employee, you're expected to be worthy of it, and your conscience may urge you to live up to such expectations.
Of course, there's diminishing returns from doing this, but the point is...
If an employee is important enough to possibly damage a company with negligence or malice, maybe that employee should be treated a little better to encourage them to put more effort in to avoid such things from happening. Economically, the additional compensation should reflect the chance of the damage times the cost of the damage if it were to occur, but it's not something easily measured.
Definition of a hacker (Score:3, Insightful)
there is no procedural or techical solution (Score:3, Interesting)
The solution is regularly teaching business ethics to students. Perhaps even make it mandatory to earn a degree. Certainly mandatory for a graduate degree.
Re:there is no procedural or techical solution (Score:5, Insightful)
There are, after all, fairly straightforward ways to secure data against the admins (assuming they don't actually install spyware, which is a separate subject.) There are also ways to arrange secure key recovery so that the records can be recovered if Something Happens to the exec, but no one person can do it (say, three board members and an outside law firm.)
And then of course... (Score:5, Insightful)
There are ways to run a business that limit the amount of information that has to be classified so that it can be relayed verbally or by sneakernet. Like not defrauding your workers or business associates is a good start, followed by not raking in huge undeserved stock options and bonuses, not downsizing and outsourcing just because it is the latest fad, and in general being competent to the point that the only people who care what's in your email are the rarer criminal element and not every damn single employee.
Ahh, driftnet on the switch monitor port. Never has there been such an artistically odd juxtaposition of shoes, porn, corporate logos, and vacation photos.
Options and bonuses for boss are sometimes good (Score:4, Insightful)
While I agree that there have been terrible abuses here, I also recognize that sometimes these options and bonuses are appropriate but that is not always readily apparent. First there is the agent problem. The boss is sometimes merely an agent of the owner(s), how do you make sure he acts in a manner that improves the owners situation rather than his own? Options are one way. This also works up and down the ranks, for bosses and workers. The other area where a big seemingly undeserved bonus is appropriate is for the founder(s) who lost interest/investment income by spending his/her saving to start a business, lost salary income as he/she worked for no salary or a partial salary in the early days of the business, who risked their financially security and reputation to pursing a dream, etc. If they get a couple of big bonuses to repay and compensate for the preceding once the company becomes established, IMHO that is fair. I've seen small companies get bought out, and I've seen employees complain that they got a far smaller bonus than the founder they worked side by side with. What these employees failed to realize is that they took little risk, and that their boss made personal sacrifices so that their payroll checks were there on schedule.
Is the above a typical scenario? I have no idea, but I have seen it a couple of times. I believe it happens often enough to warrant mentioning among the stream of expected "bosses are evil and all profit should go to those doing the work" follow ups. Like many topics, things are far more complicated than they seem.
Re: (Score:2)
There are ways to mitigate against having to trust one person too much, like separa
Re: (Score:3, Interesting)
as I was saying, I have an ecrypted disk image, which stores my sensitive files. Tax file documents, and other such documents. Also on that image are the data files, and configuration files for an application. The data files are encrypted by the application, so that I can have my passwords secured(twice).
When i double click on the app it tries to load it's confi
Re:there is no procedural or techical solution (Score:5, Insightful)
In my consulting work I have worked with systems containing sensitive information. Outside the workplace and outside the context of my particular role the information was of no interest to me.
Re:there is no procedural or techical solution (Score:5, Insightful)
The DMV does it (every once in a while some bozo is fired from the state DMV for looking up minor celebrities information), I am sure many other less involved database systems can too.
Re: (Score:3, Insightful)
a pragmatic solution (Score:2, Insightful)
Re: (Score:2, Insightful)
The solution is regularly teaching business ethics to students. Perhaps even make it mandatory to earn a degree. Certainly mandatory for a graduate degree.
The suggestion that a mandatory degree and ethics classes will solve the problem is laughable. Many examples of why this is so exist: Citigroup, Enron, Worldcom... to name a few. Do they teach business ethics in MBA or CPA programs? Of course they do. Did it help? No.
Re: (Score:2)
But the people who really need to learn business ethics are the stuffed shirts in the corner offices. They need to learn that they shouldn't turn around and blame IT that their laptop is broken when they installed AOL on it the night before their big presentation. Then it might leak
Re: (Score:2)
What you are proposing is that every student has to be bored senseless in ethics class because you do not have an idea that will work!
I think it would be just better if everybody woke up to the fact that business is the pursuit of wealth. There are enough greedy bastards in the world that to convert them all to ethics is impossible. So just make sure everybody knows that businesses cannot be trusted and leave it at that. No new laws, no sensless law cases, you invest in a business yo
Re: (Score:2)
Re: (Score:2)
Clueless in the corner office (Score:5, Interesting)
I realize it's a business problem when the CxO doesn't have a clue about encryption, but who's going to demand he get some education?
FWIW, the legal profession actually has directives from the Bar Associations on when it's even permitted to use e-mail, and if so when encryption is required. Sometimes it's nice to actually have authority over you.
Re: (Score:3, Insightful)
Los Angeles Bar Association: "Lawyers are not required to encrypt e-mail containing confidential client communications because e-mail poses no greater risk of interception and disclosure than regular mail, phones or faxes."
http://www.netlawtools.com/security/emailsecurity1
The American National Bar Association takes a similar stance, but the above link does warn that if an unencrypted email is intercepted, th
It is all part of the job (Score:5, Insightful)
Admins have access to everything. Or at least they should have access to virtually everything. Because who would you call if it was broken? certainly not the corner office.
Trust is necessary. You have to trust your admins. And if you have an admin that leaves under suspicious or grievious circumstances, you protect your corporations ass with a dismissal agreement.
TRUST. (Score:2, Interesting)
From a CEO's perspective you trust that your subordinates do their job, so that their subordinates are able to do their job all the way down to janitorial staff. Granted your level of trust declines proportionally to the level of visibility, but if the janitorial staff fails to take out the garbage for a week...
Re: (Score:3, Insightful)
Sorry, but here are quite a number of methods by which the admin could track down an errant email or such without knowing its contents.
Its like passwords, your argument has been used before by people who defend systems in which the password is retrievable. The only way for me to know a user's password in my systems is if I set it myself or they tell me. There is not a method to recover them. The same can be done for the text and such of the mail.
Re: (Score:2, Insightful)
I guess it is a problem with assumption. Corners assume communication is privileged, and private. Well, it isn't. It's like using a megaphone to talk through the wall to the office next doo
Re:It is all part of the job (Score:4, Insightful)
Except that assigning a new password and "destroying" the old one is a perfectly acceptable solution. So there is no need for anyone to be able to recover the old one. Destroying a document is not an acceptable solution -- if my boss needs me to recover a document, I need to be able to do it, whether it is by interacting with the application, searching through cache data, or scouring the individual hard disk sectors.
Ultimately it does come down to trust (or greater monitoring), but you can't remove the fundamental ability of IT to be able to access all corporate data in some manner if you expect them to provide comprehensive support to the organization.
Re: (Score:3, Informative)
Nope. You just encrypt everything. Everyone gets a USB keychain (or something similar). You keep a backup copy of all the keys on discs which you store in a safe. The admin can still manage stuff, but can't actually read, only the owner of the key can. If a user requires assistance in finding a file in an encrypted filesystem, then the admin might have to use remote desktop (or visit in person) and find the file under the supervision of the user. If a user loses their key, the admin has to go to the vault,
Re: (Score:3, Insightful)
But in that scenario, IT can still get access to the encrypted data if they really want to. They can install a key logger and a tool that records your screen contents at intervals. Face it, you have to trust everyone who's able to install software on your computer.
So wh
Re: (Score:3, Insightful)
Ultimately you do have to trust the IT department not to go to the vault together and decrypt everything over the weekend. They have to be able to decrypt things without the user, that's just a fundamental requirement for data preservation. You can put all the auditing a
Re:It is all part of the job (Score:5, Insightful)
That depends on who you work for/with. My boss likes to ask for things like:
"Can you print me a copy of that e-mail I sent about our new sales strategy a few months ago? I think I deleted it."
"Do you remember who you sent it to?
"No."
"Do you remember the date you sent it?"
"Oh, a while ago."
"What was it about?"
"Sales."
So anyway, when you work for people who routinely ask you questions that are about as specific as: "Hey, can you find me the thing I wrote about something just the other day?" it's helpful to be able to do fulltext searches and keep blunt throwable objects out of arm's reach.
Re:It is all part of the job (Score:4, Insightful)
Yeah, people don't get what's going. In the first place, e-mail isn't a secure form of communication. It's usually transmitted unencrypted, and often your authentication to your e-mail server isn't encrypted. Whoever is running your e-mail server, whether it's your ISP or Google, can read your e-mail if they really want, and mostly you're relying on them to be disinterested in the matters you're sending back and forth. People should understand this.
However, the second component here is that, if you can't trust your IT staff, you are in big trouble. The reason is this: even if you put security measures in place to restrict IT access to e-mail messages, your IT staff is going to have to put that in place. If you can't trust the person who institutes your security, you won't know for sure whether they left themselves a back-door in. Basically, you're trying to lock people out of a system that they've set up themselves, and they know the system better than you do (or you probably wouldn't have hired them).
So the best solution-- the only solution-- is to hire IT people you can trust. When you hand over control of your network to someone, imagine it being like handing over keys to a storage room with all your information in it, with only their integrity to keep them from browsing through it.
As an aside: you should also be careful about the communications you have through your office e-mail. Even well-intentioned trustworthy support personnel might stumble across it while fixing problems or troubleshooting. Take it from a guy who's accidentally stumbled across e-mail from an executive's mistress before. I was just browsing trough our spam filter to look for false positives, and there it was. I wasn't looking for it, wish I hadn't seen it, and didn't want to know, but there it was. So as a rule, if you have personal information you wouldn't feel comfortable telling your IT people (like that you're having an affair and doing coke on weekends), don't talk about it in your work e-mail account.
Re: (Score:3, Interesting)
Our accounting person has handled personal bank information for my direct deposit information. OH NOES!!
Lets make everyone who does anything get licensed by the state. That is what we need. More state licensing.
PGP mainstream? (Score:2)
Re: (Score:3, Insightful)
Dog bites man. I (Score:5, Insightful)
The rest of the article is all over the place. There's some mention of rogue admins reading executive e-mail rolled into boilerplate security talk about how X% of security risks are insider threats, and then it finishes up with a vaguely related sales pitch for RSA products, owned by... yep, EMC. The guys providing ComputerWorld with ad revenue on that sidebar.
Hopefully those scared VPs will hire consultants and purchase EMC products to "secure" their infrastructure from "rogue admins" who are probably reading their e-mail RIGHT NOW.
Re: (Score:3, Insightful)
Computrerworld is nota very highly regarded magazine. It's a freebie they shove down your throat. only middled managers actually put ant value into that rag's words. All this article does is fester distrust of the IT department from managers that have not a clue.
your IT admins can bury your company and wield far more power than the executive staff combined does. Yet compared to all other departments IT get's the lowest pay.
One admin with all they keys can easily take down anyone
Re: (Score:2)
Access != Type to access (Score:2)
Access to that information is pretty much required and a given for SOMEBODY. Otherwise, you sorta can't build the system in the first place.
Having the ability to access that doesn't mean they DO. It's just that if the person happens to want to, the ability of accessing it is not a block if they do, in fact have access.
Submitter makes it sound like all IT types are nosy BOFH criminals, which is not the case. Sure, SOME are, but then again I be
big deal (Score:2, Insightful)
Re: (Score:3, Insightful)
You just haven't found anything worth caring about yet. Wait till you find out that all of the people who are at the same level in the org chart as you are make $20K more a year than you, and they all come to you all the time to get things done because none of them know what they're doing. Or that the person reporting to you makes $30K more. Or that the company subsidizes the CEO's political fundraisers (worse if it's for a political party you strongly oppose).
Keep loo
If you don't trust your Sysadmin(s)... (Score:3, Insightful)
...Then the battle is already lost. You may as well close up shop and go home.
Which is not to say there aren't unscrupulous people out there who will abuse positions of trust, but this is a HR issue, not a technical/security one (and is most certainly not one limited to the IT department).
I have access.. (Score:2, Insightful)
Yeah, it happens (Score:2)
Most companies warn new employees that their email and other electronic activities can and will be monitored. Why should execs be any different?
This is normal and necessary (Score:5, Insightful)
As an anecdote, one of my customers (I am an IT consultant) lost the password to the video surveillance system. They immediately came to me, and were shocked and annoyed when I said 'Sorry, I wasn't involved in the installation of that system and was never informed of the passwords.' In the end, we found that a user had written down the password at one point and were able to get back in that way!
The point really should be that companies better find upper IT staff that they can TRUST! If they can't trust their IT staff, they have big problems.
Re:This is normal and necessary (Score:5, Interesting)
Unlogged.
Do I?
Hell, no.
It would be nice to pretend it is all about ethics, but let's be realistic: it is really about "why would I -care- what they are jabbering about?" These are people who complain about getting "unbearable amounts of spam" when they get a total of a half dozen emails a day...
Sorry: nethack, dinking around on forums and mailing lists, listening to music... all of them are much more important than the sort of nonsense people send in mail. I really don't care what people mail each other, how many porn sites they visit or whatever it is they actually do online as long as they leave me alone.
It isnt ethics: it is pure and simple apathy about them.
Bullshit (Score:3, Interesting)
In big business, the data should be secure. Period. You lose your password, you lose your information - it's that simple. Oh, sure, you can^Wmust have a contingency plan (the three board members and an outside law firm) if somebody gets hit by a bus, but it really should be a hard process to implement retrieval. Would that embarrass the
Re: (Score:3, Insightful)
In your example (which boils down to two man working
Re: (Score:3, Insightful)
That's a perfect strategy for security if you completely disregard human behavior. If you set the stakes so high for forgetting your password, you end up with people either using ridiculously simple passwords (so they remember) or writing their passwords on post-it notes underneath their keyboard. Congratulations, now your system is less secure.
Secretaries are a bigger issue (Score:5, Informative)
Re:Secretaries are a bigger issue (Score:5, Funny)
I was once trying to explain to an exec why his account would never be absolutely secure.
Me: "If somebody wants your account information badly enough, he's going to get it. He doesn't have to hack the system, he can just get it from you." ... Which daughter?
Exec: "That's crazy, I'd never give anyone my password."
Me: "Imagine you come home and find someone's broken in. He's got a gun to your daughter's head, and he tells you he's going to shoot in ten seconds if you don't give him your password. What would you do?"
Exec: [long pause]
To this day I still don't know if he was joking. But I no longer use that example.
This is old news. (Score:4, Funny)
Weird paranoia... (Score:2)
non-story (Score:2)
Do these companies not have data classifications and policies around what must be done with secret/confidential information? Do the employees (including execs) not understand these classifications? Why not?
Any of this is a failure of your organization's ability to create proper security policies and ensure that employees understand what compliance means.
Email is plaintext unless you do something with it. Same goes for any data that is stored on any servers in your company. If it is confidential
One thing that would solve this... (Score:4, Insightful)
Fucking Computerworld fear-mongering! (Score:5, Interesting)
What they fail to grasp is I don't have time to be going through their shit!
Conversely PHBs don't have time to learn how to admin mail systems, which is what they'd have to do in order to keep me out.
Here's a novel concept: Why don't you simply try hiring people who are trustworthy?
Re: (Score:3, Funny)
Delegation (Score:2)
At any rate, since Exchange is fully integrated with Active Directory, organizations often give administrators control over only certain subsets of e-mail accounts. For instance, if Company has 5 offices
Wow, what a shocker! (Score:2)
Idiots - of course sysadmins can read everyone's email. This is why you should take care in hiring them.
Just does wear.. (Score:2)
bounces are better (Score:5, Funny)
I created a t-shirt for work a couple of years back when I heard someone saying that we were reading their e-mails.
"I Read Your E-mail"
" It's Boring "
[John]
Another reminder about email insecurity (Score:3, Informative)
Malicious... or just plain crazy? (Score:5, Interesting)
We tracked the hacker down. It turned out it was another admin, who had gone some kind of crazy. He had three NICs in his desktop box all configured to impersonate different machines, he had re-routed the boss's email through his mailbox (and some clients' mail too), and had all kinds of other things going on. And he had sat there the whole time we were trying to ID the hacker, pretending nothing was going on, all the while trying to stay ahead of us. Strangest thing I ever saw.
Yes, he was fired. He really didn't seem to know why he'd done it (none of it made rational sense) and he'd really put his family in a bind. I think he was sick, but I'm not a psychiatrist.
two man rule (Score:3, Interesting)
postcard (Score:5, Insightful)
ie it could be read during transmission buy the post-office worker (sys-admin)....
just a gentle reminder.
Re:And slashdot comments? (Score:5, Funny)
What about the /. admins who can read our highly sensitive comments?
Comments? I'm not even sure they read the article summaries.
Re:And slashdot comments? (Score:5, Funny)
English: "Sys-Admins Reading the Boss' Mail?"
Slashdot: "Sys-Admins Reading the Bosses Mail?"
For an admin reading the e-mail of more than one boss, the title would be:
English: "Sys-Admins Reading the Bosses' Mail?"
Slashdot: "Sys-Admins Reading the Bosseses Mail?"
Re:And slashdot comments? (Score:5, Funny)
Re:And slashdot comments? (Score:5, Funny)
Re: (Score:3, Funny)
Re: (Score:2)
So the person got fired instead of going to jail? Illegal means illegal, and I would argue that your civic duty would be to inform the authorities, not upper management.