User tricks, security treats

30.10.2006
Thirteen malevolent spirits may haunt the halls and cubicles of your company, and if you're going to scare them into security compliance, you may need to get a little bit spooky yourself. Have a few treats up your sleeve to return for these goblins' sinister tricks.

The privileged executive

Her trick

The privileged executive feels responsible for every aspect of the organization, and compelled to control it. She wants to know everything about every department and project; demands root access to systems and applications, and sufficient rights to act on others' behalf -- including sending e-mail using other employees' accounts. Naturally, she objects to the logging of her own activities while demanding stringent audit of everyone else.

Your treat

Forward articles on prosecution of executives for insider trading, misusing data, and Sarbanes-Oxley Act violations, particularly ones that detail how malfeasance got pinned on the corner office because of too much access. Follow up a few days after each prying event by hinting to IT that it ought to look into apparent audit discrepancies, and suggesting to internal auditors they ought to look into IT control logs. Send monthly updates about how you're working hard to make sure the execs aren't exposed to excess risk; make plausible deniability your mantra.