When Infosec and Weed Collide: Handling Administrative Actions Safely

A state auditor found a critical design/operational weakness in Ohio’s medical-marijuana grow application webapp where two Commerce employees had unlimited access to reviewer accounts and credentials, enabling untraceable impersonation and potential score/document manipulation; the post explains how such administrative access breaks audit trails and recommends mitigations (self-service password flows, “ride-along” support, and explicit impersonation logging).