SHARK TANK

Screenshot shakes up user

New Zealand pilot fish is rolling out a new version of an in-house application to several hundred remote users. They have to download an executable and follow the instructions contained in an email. The email includes screenshots and very explicit step-by-step instructions on how to install the application.

"I receive a call from a frustrated user who can't seem to get her installation to progress past 29%," fish recalls.

"She's made several attempts, and installation seems to hang on 29% every time. "The helpdesk shadows the user's Citrix session in order to see what the problem might be. As promised, on her screen is the progress bar, frozen at 29%. "Helpdesk takes control of the session and the problem immediately becomes apparent. The conversation goes something like this:

Helpdesk: "You have successfully installed the application"
User: "But how? it doesn't seem to go past 29%"
Helpdesk: "What you're looking at is a screenshot of the installation, in the email I sent you. It will never go past 29%, it's just a picture"

User: "oh"

Not the perfect password

At a government agency, the treasurer's office decides it needs new software to run its cashiers' stations, according to a pilot fish in IT.

"The new system has, against IT's recommendations, a single user sign-on and password," says fish.

"IT programmers and system administrators did their best to convince them that for security, accountability and separation of duties, this was just a bad idea, as having a single user sign-on to the system prevents tracking of who is making transactions.

But the treasurer and the software vendor disagree with IT's recommendation — and the application is designed and coded so that all cashiers will use the same sign-on and password.

Finally, the day comes to install and test the new system, and the treasurer's office makes a big deal of inviting IT staffers to come and see it.

The treasurer and vendor rep proudly announce that the cashiers will sign on with the user ID 'Cash', and only the cashiers and supervisors will know the password.

The IT manager listens, then says, "Oh, and what is the password — 'Money'?"

The treasurer's and vendor rep's faces suddenly go ashen.

"It seems they didn't put much thought into a hard-to-guess password, and their system was not as secure as they thought," fish says.

"Before testing was finished, the application was changed to allow individual user IDs and passwords. It took a little longer, but transactions are now tracked by the user ID, date and time."