Every depot has a terminal in the drivers' room. Drivers use it to check tomorrow's route, confirm their hours and print a run sheet. It sits on a shelf beside the kettle.
In June our payroll team queried a set of timesheet changes at one of our Midlands depots. Overtime had been added to four drivers' records at about four in the morning on three separate nights, approved under the name of the depot's transport manager, who was on holiday in Portugal at the time. Nobody had stolen her password. The terminal in the drivers' room had been signed in as her since 2022, when she set it up herself, at a time when her account could do little more than view routes. She had been promoted twice since. Every permission she gained along the way had also been granted to the terminal by the kettle.
We checked the estate. There are sixty four shared terminals across our depots, in drivers' rooms, goods in offices and canteens. Twenty two were permanently signed in as a named person, because the easiest way to make a terminal open its applications automatically was with the account of whoever installed it. Nine of those people now held manager rights in the time and attendance system. Two had left the company, and their sessions had survived because the terminals had not been restarted since before they went.
None of this looked like a security problem from where we sat. Our access reviews checked which permissions each person held, and each of those people was entitled to theirs. The reviews never asked where those permissions were being used, and on a shared screen a personal account is an account anybody can borrow.
Shared terminals now sign in as the device, with an account that can only do what the room is for: view routes, print run sheets, and confirm a driver's own hours. Anything beyond that needs a person to tap their badge and enter a four digit code, and their session ends when they walk away or after two minutes idle. Terminals restart every night, and a personal account signed in on a shared device for more than an hour raises an alert. The overtime was reversed.
A permission is granted to a person and used through a screen. Our reviews had only ever looked at the person.
– Serguey Shinder
Top comments (0)