Re: How do you manage your QSECOFR profile and other Q profiles?

On Tue, Aug 12, 2008 at 12:24 AM, <macwheel99@xxxxxxxxxx> wrote:

That IT repair person has a master directory of the passwords used by all co-
workers to get onto company network, 400, e-mail, pin # for phone messages,
the whole 9 yards, to facilitate that tech support.
I have seen that master list laying around in plain sight on IT co-worker
desks.

Yeah, and all IT workers can impersonate everyone. That is the wrong
approach to use.

First, use a central authentication database - one username and one
password per employee. Unfortunately, SSO is on the i is not trivial
to setup, but it is doable. This generally improves security as
employees have to remember less passwords.

If a technician needs to logon as a user, he can reset his password.
This will generate appropriate audit events, and automatically lets
the user know that his account has been used by someone else, as his
previous password is invalidated.