I would never let my manager into my Linux systems, just to make an analogy. I give my manager a report on what's going on but I'd never let them in. Because they're not competent enough to handle them.
Yet these top directors are able to get access to essentially any database or system just because of their title.
For some systems team leaders who needed wide access to data had to pass security clearing at the TS / DV level I was told.
Reading your comment makes me imagine HM The Queen in the royal carriage, being bored at the slow pace, staring at her smartphone, scrolling through Instagram.
The irony was the press office was on the floor above and didn't notice.
Telemarketer: When you sign up with ShitWare, our Platinum partner, you get a free BigMac (tm) with a crumpet and a small drink! This exciting promotion is only available to our subscribers! Limited time offer. Quantities are limited. Only in participating restaurants. Some conditions apply. Taxes (incl. VAT) not included.
Queen: Goodness gracious, did you just say free BigMac (tm) and crumpets? That is, like, fucking amazing! OK I clicked on that link, it says "Your Windows is infected! Click here to clean!" Is that OK? Btw where is my food.
Telemarketer: It is, indeed, perfectly OK! Just click on where it says "I Agree". BTW it is one crumpet (not "crumpets") or a hashbrown, subject to availability. This exciting, time-limited offer is ---
Queen: Yeah whatever dude, just send the food in.
Queen: This is good. Most good.
Is that something that BT would intercept?
I'm not sure about the chain of command in your company but in most companies, managers don't need permission from their charges for access. Managers are the ones who give their underlings access.
Granted, in most tech infrastructure, only a handful of people might have direct access to production/sensitive assets like databases, file, web, etc servers. And managers wouldn't want to muck around on production servers. But the idea that you wouldn't let your manager access or that they couldn't get access if require seems very odd. What happens if you quit or get fired? If your manager wanted access and you refused, he has the power to fire you.
> Yet these top directors are able to get access to essentially any database or system just because of their title.
Depending on their role, directors of any company can get access to anything because they act as the ultimate arbiters on behalf of the shareholders. The chairman of the board is who the CEO of companies report to.
Sure, you wouldn't want people who don't know the systems to gain access. But I'd be interested to know how a low level employee can prevent their manager or even directors from access if they wanted it.
The info was surely sensitive, but I don't see this article indicating that any of the information was classified (let alone TS). That would be a major vulnerability, normally guarded against by using completely separate systems to access such information.
If you do not, he rightly fires you.
There are of course many legal cases where administrative access is limited.
What you are describing is scary : you hold the company in hostage, and the company is apparently happy with this since it allows such a posture from their admin team.
Beside the legal aspects I mentioned, I always had complete access to all the thousands machines and services I was ultimately in charge of. I would have test scenarios to ensure access is granted, but did not log into them because there was no reason to do so (and I may break something).
Note: the way how the acces is provided in another story. It should be documented, traceable, etc.
I once had an IT guy who was making up his own passwords for workstations and servers. When he refused to provide them to me I had our attorney meet with him so he could clearly understand the implications. He was holding the company hostage and violating policy. He provided the passwords at the end of that meeting and was fired on the spot.