Recently, I walked up to a receptionist at a Fortune 500 company, and told her I forgot my badge. She smiled and let me in without any verification or escort (she didn’t know I was legit or just a nasty visitor).
This is a company that:
- Has security guards who carry handcuffs and patrol the parking lot during busy times.
- Not only insists badges are worn visible at all times, but prints your name on the BACK of the badge so everyone can still see your name if your badge flips over.
- Has warnings about laptop security, keeping your desk clean, and handling confidential data plastered everywhere like political posters during a hot campaign.
- Encourages all print jobs be submitted as “locked prints.”
- Provides laptop cables to all employees.
- Requires all visitors to be escorted.
I’d been working at this company only about 3 days. I told the receptionist my name, that I didn’t have my badge, and asked if she would call the department admin to let me in.
“That’s not necessary. Just sign in. Here’s a visitor badge.”
With all the contractors this company uses, there’s no way the receptionist could have remembered me after only 3 days. I’d seen her once a day and never spoken to her, just walked by her. Usually, she was busy with another contractor. Even if she did recognize me, how did she know I was still working there? She didn’t check.
Well, believe it or not, I forgot my badge the next day also (bozo!).
When I approached the receptionist, I noticed it was a different person who I’d never seen before. I signed in, picked up a visitor badge while explaining I didn’t have my badge. Another smile, another easy entry.
Since two different receptionists let me in, either the visitor/employee entrance policy is weak or the employees are poorly trained. Or the company seldom tests whether the policy is followed.
Neither time did the receptionist verify who I was, whether I actually signed the visitor log, or checked my name against any contractor/visitor list (on the second day, I didn’t even give my name and could have written any name in the log).
At the very least, the receptionist should call the admin or manager of the department and have them escort me in (rather than me give a name for them to call). Not only does this verify that I’m an active worker, but it embarrasses me into remembering my badge more often.
So much for the security of this building’s perimeter.
Here’s an update…
It gets worse…I went back to this company for a couple days and left one day after 5:30 pm. The reception desk was empty and a pile of visitor badges (not the paper kind, but like the employee type, but without a name or picture) was laying on the counter.
I asked my colleague about it, and she said, “That’s how we handle visitor badges. You see a pile like that every night after 5:30 pm.”
I just chuckled.
ITauditSecurity 