In 1995 I was assigned to a short-term contract at Stentor. Stentor was a conglomerate of several Canadian telephone companies working together. It disbanded in 1999. In any case, I was asked to take a look at their security setup and recommend/make changes to secure it.
I nearly choked with disbelief when I logged into their system and started looking around. There simply was no security. Any kid with a modem anywhere in the world could have logged in and wrecked havoc with this highly confidential and sensitive information. Just to make it easier for the kid with the modem, the system account and password were still set to their default. The system account was the master account on VMS systems. Log into it and you could go anywhere and do anything, including messing with the internal setups of the machine. The default password for the system account was widely known. The first thing one was told to do when receiving a new VAX was to change the system password. That didn't take very long for me to fix. Plug hole number one.
There were a number of smaller issues, but the major problem with the system setup was that the entire accountability system was compromised. Anyone with any account and its password could mess up the data files and there would be no way to trace the damage back to an individual. Instead of individual accounts with real people associated with them, there were group accounts. Everyone in the accounting department, for example, used the same username and password when they logged into the system. The same for each of the other departments in the company. I wrote up a report outlining the potential damage and suggested how I would change it. They could still have group accounts, but instead of using a single username-password, every individual would have a unique username-password. They would still have access to the same programs and data as before, but now, if someone deleted a database, they could not shrug and say, I don't know who did it. It could have been anyone.
The head of the computer services department (who seemed to be troubled by my pony-tail, as he referred to it often during our interactions), gave me the go-head to fix the system. I was sensitive to user concerns and so I moved slowly. I met with representatives of each of the group accounts and explained the problem to them and what the remedy was. They agreed. So, I set about writing up a set of programs that would make the necessary changes to the system. I again met with representatives of each of the group accounts, explained the changes and how their users would log in to the system in the future and gave them a date when I would make the change. Everyone was on board.
Then I did a stupid thing, something that no programmer or analyst should ever do: I set the programs up to run overnight when I knew I was not going to be back for a couple of days because I had another contract to attend to. When I did return three days later it was to face a furious group consisting of the head of the computer services department (the one with the problem with pony-tails), the in-house system manager, and a contracted-out system manager who I am going to give a (false) name to because his path crossed with mine several times over the next few years. Let's call him JackSys--that name should stick with you when you encounter it later in my stories. Apparently when my programs ran users panicked. They claimed they couldn't log in (mainly because they were trying to use accounts that no longer existed) and both system managers panicked. It didn't matter how often I had told everyone that this was going to happen and that from now on users would have to use their real last name as their account name and would be forced to change the password on their first login.
The systems managers spent the entire night trying to restore everything to the way it had been before my changes kicked in. They finally gave up trying to undo the damage and restored the system from backup tapes. The computer services head told me I had two days to make sure that all the damage was undone and to write up a report on the state of their security. And so, I did.
A few days later JackSys phoned and asked me to forward to him an electronic copy of my report. I didn't want to do it. Electronic documents can easily be changed. But, I felt I had no choice. I was in everyone's doghouse and could not depend on anyone to back me up if I refused to cooperate. And so, I did.
Footnote: four years later (in 1999) I was working on contract at Corrections Canada when they took on another VMS professional. This guy knew me, though I did not know him and hadn't met him before. He told me of how he had seen my name on programs over the years and was very impressed with my technical skill. He also told me that he had been contracted to Stentor, some time after my banishment, in order to address their security concerns. He found the same mess I had when I was there. But, in looking around he came across the programs I had written to correct the situation and well as my security report. JackSys was still there and said that he had written the code and the report--his name was on the programs. However, my new-found friend knew JackSys and that he, JackSys, didn't have the talent or the command of written English evidenced--and, he recognized my style of writing programs. He went to the same head of computer operations that I had reported to and told him that the security situation was absolutely untenable--and if they didn't implement my solution, then they were leaving themselves open to damage and lawsuits. My programs were run and the system secured as I had recommended.
No comments:
Post a Comment