Heck, this person probably also knows the passwords of a half dozen
other key people in the firm, too; not just his own?
Tom Liotta wrote:
Steve Martinson wrote:
... likely knows passwords for many service and/or utility profiles on the
This piece is tough. Not only would the individual know of common
utility profiles, but might also know of 'utility profiles' that no
one else realizes are utility profiles. From there, possibly knows
of programs/functions/procs that take advantage of utility profiles
by way of adoption or swapping or even by direct communication with
I.e., a review of the 'Created by...' attribute, for example, for
all profiles might be in order. From there, a chain might be
established to uncover relationships that aren't obvious.
This doesn't mean that anything was done deliberately; it simply
acknowledges that a project from a couple years ago might have
resulted in a 'test' profile or function that's been forgotten. Such
profiles might look like any other user profile. All such profiles
may have private authorities to almost anything, including other
BTW, I didn't see if anyone mentioned validation lists yet... review
any that exist and ensure that their purpose and usage is understood.