In July a trade counter assistant at one of our branches left to work for a competitor. A month later the branch manager noticed that somebody had signed in to a supplier's ordering portal with the branch's shared login and looked at our buying prices three days running. The sign in came from a home broadband connection.
It took us a day to work out how. The counter PC at that branch, like most of ours, is used by four or five people in a shift. Staff had saved the passwords for supplier portals, the carrier booking site and our own trade website in the browser, because typing them at a busy counter is slow. Two years earlier the assistant had signed the browser into her personal account to get her own bookmarks. The browser did what it is designed to do. It synchronised everything saved on that PC to her account, and from there to her phone and her laptop at home. When she left, the passwords left with her, and nothing on our side recorded it.
We then checked the rest of the estate. Of the three hundred and ten shared PCs at our branches and depots, sixty four had a browser signed in to a personal account. Between them they had synchronised four hundred and thirty saved passwords to accounts we did not control, belonging to thirty nine people, eleven of whom no longer worked for us. We had no reason to think the others had misused anything, but we could not show that they had not.
We changed every one of those passwords within a fortnight, starting with anything that could place an order or move money. Our device policy now allows the browser to sign in only with a work account, and saving passwords in the browser is switched off on shared PCs. The shared logins the counters genuinely need are kept in a password manager with access by role, so when someone leaves, their access goes when their account does. We told the supplier whose portal had been used, and it reset our account.
We had thought of the browser as a window onto websites. On a company PC it is also a copying tool, and it copies to whichever account is signed in to it. Decide which accounts it is allowed to copy to.
– Serguey Shinder
Top comments (0)