Dark Bilious Vapors

From La Reg: Federal agency faulted for weak security Apparently the Federal Deposit Insurance Corporation isn't exactly on the cutting edge of "cybersecurity", and a few folks are alarmed.

That reminds me of my time as a consultant. I was assigned to do some Sybase database consulting for a bank (that will remain nameless) which was, at the time, undergoing a periodic FDIC security audit. As part of my consulting, I needed to access the database server with Sybase system administrator privileges, so I asked the head IT guy there if he'd log onto the server as sa for me. This bank had elected to maintain the default Sybase sa administrator account, but at least they put a pretty secure password on that account. Except for one small problem.

In response to my request, the head IT guy walked me over to the database server console, and pointed to a memorandum stapled to the cubicle wall next to the console. On the memorandum (which, interestingly enough, was apparently distributed to a number of people outside the IT department), was the sa account password....

For political reasons (i.e., the bank was owned by the in-laws of the president of the company that I worked for), I kept my mouth shut. But to this day I wonder how well they passed the security audit.

Len on 06.01.04 @ 09:01 AM CST