PGP in the workplace

Here's one I figure you all would just love:

Yesterday afternoon, I was told by some higher-level associates of mine
(not Management level, mind you, just people higher on the food chain) that
my use of PGP in the coporate environment was not appreciated and could
result in my being looked upon *very* unfavorably by the managerial crowd.
Without even delving into security reasons, I politely explained to them
that due to my job (which has several crypto-related applications) I needed
PGP to communicate with people and list-bots in the outside world (or they
could gladly pay for my formal training).  The just shook their heads and
said "be careful, you've been noticed".  I was then told to stop 'messing
around' in my shell account.  I asked what was meant by this, and
apparently it had been noticed that I had done a few things, which I had
done to simply check the security of my account, which could be viewed as
'inappropriate'.  You know what they were?

1. I checked to see if the passwd file was available to anyone (was it
shadowed, etc.).  This was seen as an attempt to GET the passwd file, and
thereby have access to sensitive data.

2. I change my password regularly (once a week).  Now this may seem
excessive (it apparently did to them), but you must understand that the
entire IS department is extremely buddy-buddy here.  Over half of the users
have root passwords on any given system.  I don't feel like sharing,
horrible me.  I guess my regular chaning of passwords was seen as a strain
on the system (ha!), as they didn't elaborate *why* I had been flagged for
this.

Upon explaining to them that I was simply trying to make sure of my own
security, I was told that I was to just assume that I was secure, and that
*any* 'poking around' was found to be "highly aggravating" and could only
only "exascerbate the situation further."

Luckily, I had to get to class, so I cut the conversation before it could
get any more out of control.

Now, seeing as I'm fairly new to the Corporate world, but is this something
common?  I know when I was at college, poking around was expected and
encouraged, as it helped find and plug holes in the system.  But this is
almost like some kind of protection racket here!


____________________________________________________________
Rick Osborne                     osborne@gateway.grumman.com
"Yes, evil comes in many forms, whether it be a man-eating
 cow or Joseph Stalin, but you can't let the package hide
 the pudding!  Evil is just plain bad!  You don't cotton to
 it.  You gotta smack it in the nose with the rolled-up
 newspaper of goodness!  Bad dog!  Bad dog!" - The Tick

On Tue, 17 Sep 1996, Rick Osborne wrote:
[clueless sysadmin story elided] 
> Now, seeing as I'm fairly new to the Corporate world, but is this something
> common?  I know when I was at college, poking around was expected and
> encouraged, as it helped find and plug holes in the system.  But this is
> almost like some kind of protection racket here!

This never happend in any company I worked for. Don't think I'd last in 
such an environment. Neither, one should think, will a company where half 
the people have root. Three man operations excepted.

Just my $0.02,

--Lucky

Rick Osborne writes:
> 
> Here's one I figure you all would just love:

[...]

> Upon explaining to them that I was simply trying to make sure of my own
> security, I was told that I was to just assume that I was secure, and that
> *any* 'poking around' was found to be "highly aggravating" and could only
> only "exascerbate the situation further."


Quit and go work somewhere that's reasonable.  A decent IS department
doesn't play games like these; one that's full of morons does.

Talented people, especially those who know security, are
in demand at the moment.  So you shouldn't have to put up with
petty-tyrant bullshit- go find a company that is staffed by human beings.


-- 
Eric Murray  ericm@lne.com  ericm@motorcycle.com  http://www.lne.com/ericm
PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03  92 E8 AC E6 7E 27 29 AF