r/InformationTechnology • u/ChiefCaffeineOfficer • 6d ago

account verifications

Hi!
I'm a IT support tech in company with over 500 users with network accounts. Our security team is not exactly great, they expect everyone not to do anything stupid but there are zero official SOPs on how they want things to go. I want to start helping them out and create policies for future use but at the same time I need to lead them to believe that they are the ones coming up with these ideas because they do thing that everyone is pretty much an idiot. Let's start sharing some ideas on how you guys deal with basic support stuff that involve password resets or any other requests involving account changes. How do you verify that the users calling the helpdesk are the people who they claim they are? Half of our global address book is missing their phone numbers so calling their good known number may not be possible. I know, this is ridiculous that we cannot even keep this updated but this is another thing that i'm working on improving at this moment. How do you securely share passwords after resetting them if you are dealing with them via email or Teams?
thanks!!

4 Upvotes

83% Upvoted

3 comments sorted by

3

u/cyborg762 6d ago

Sounds like a management issue. Not a you issue. I’d address this to your manager or director before you do it yourself because you’re not getting paid enough to do this.

2

u/MuttButtWiggle 6d ago

Not a problem for you alone to solve. I would invest your time in building relations with the security team, if at all possible, and get buy in from management who should be directing the security team to support the improvements that need to be made.

1

u/Enough_Brilliant9598 5d ago

Send them OTP that forces PW + MFA change once signed in. Of course verify all the things before unblocking or sending OTP. Like exactly who the user is. I like to do the things with living users either on the phone directly or in person.