Chaos Broke Loose
I work for a corporation where users handle enough information to be able to commit at least 2-3 felonies for every little query they touch. As such, they have a lot of policies that seem like extreme overkill, but on some level I agree with the attempt. The actual application of the rules I think borders on insanity but the attempts aren’t all complete failures.
Anyway, because of this there’s an “internal” USB connector inside the case of the computers, and all the “external” USB ports have physical blocks super glued in. So, Friday morning 8:00 am I’m sitting around waiting for a ticket or something to do. I get a call in that a computer can’t login. There’s no ticket because…well they can’t log in to start a ticket. Entirely understandable.
The computer is network login, so there are 1,000 different things it can be. Heck, it could just be unplugged and not turning on. Y’all know how users can be. I head up to their cubicle and start checking. Everything is plugged in, the computer turns on and there’s no internet. I switch her network cord with her neighbor’s to check the cord.
Her neighbor’s computer connects with her jack. I log into the local admin account and there’s no internet connection or network connection at all. Check device manager and there’s the problem. The driver for the onboard network got corrupted or something, can’t roll it back either.
Great, this means I need authorization from cyber security to use a flash drive, and then I’ll need to tear the computer apart to get to a USB port that is hidden inside the case that isn’t superglued. Now, the key for the case requires my supervisor to sign off on it and give me the key for the case lock, as well I have to write up the ticket and put it into the system.
I run down to the bat cave and download the driver for her computer and email it to my boss, with a note to stick it on a thumb drive. And then walk to his desk. “Hey boss I emailed you a network driver I need on a thumb drive. I also need you to submit my authorization form to cyber security for the use of a portable storage device”. Yes that really is two forms.
So we sent the form off to cyber security to authorize. Half an hour later, no response. Head of IT calls down to cyber security to get an ETA. 10 minutes later the request comes back as denied.
Turns out, we got the biggest idiot ever reviewing the request. She has a tendency to just completely drop the ball. Before she took the job in cyber security she had neither experience in cyber security, nor any basic understanding of IT. But it’s OK, she can haphazardly enforce rules she doesn’t understand, and she spends her day helping idiots reset their passwords using the password reset tool.
So my boss has to call her and explain the situation. After five minutes on the phone he has to go upstairs to the boss of cyber security and explain why she’s an idiot today. Half an hour later, the approval from cyber security comes in to my email and my boss texts me to grab the form from him, and his spare keys and USB drive.
Now I have both authorization forms and I return to the woman’s desk. She left a note for me that she’s making a Starbucks run and will be back. I power down her computer and turn it on its side so I can get it open to plug the USB in. I’m standing there fiddling with the flash drive—then chaos broke loose. Someone yanks it out of my hand tosses it to the floor and starts stomping on it.
“What the heck are you doing”?
“USB devices are banned” he replied.
“WHOAH WHOAH. First of all, I have an authorization form from cyber security. Second of all, that’s company property, and third of all, you just destroyed evidence” I tell the idiot. I call my boss and he’s still in the cyber security office as I explain what went down.
Cyber security overhears this exchange. Cyber security decides to open a file on mishandling of suspect data. Around about 11:00 am my boss comes back to the user’s desk with a different flash drive and the drivers for the network adapter and another stack of new forms for him to do the work.
I spent an hour with cyber security filling out paper work about the destruction of a $5.00 flash drive, giving my statement on the data mishandling, and my statement responding to the accusation of using a USB storage device. So it took 3 hours and 15 minutes of two techs’ time (including the head of IT) to reinstall a network driver.
And now they have to pay a data recovery specialist God only knows how much to try to recover nothing of any value on a $5.00 flash drive, just to prove there was nothing malicious on it. It gets more ridiculous. I’m on paid leave because they don’t know for certain what’s on the flash drive.
Cyber security told me that as long as data recovery finds what I said is on it, or can’t find anything, I’m in the clear. If the drive hadn’t been smashed, cyber security could/would have just looked at the USB drive and looked at what is on the drive. Should have taken like eight seconds to do.
Instead, I can collect pay checks until the data recovery experts take a few cracks at the USB drive. But the good news is that I got to go home early on a Friday.