Jtdcftul

A colleague of mine had some very privileged access to sensitive information, that was kept in remote machines with no internet access whose files could not be copied to local machines.

He quit the company for a new job, and there was bit of trouble in the transition when he left.

One point that seemed obvious to me, but other people in the company seem not to agree was:

I believe the severing of his accesses should not have been discussed with him.

Part of this, was because some of his accesses were made through methods that were not agreed upon (pretty sure he was never authorized to do so). And it may not be clear to everyone that this happened. The area's director was informed and took no action in the past, he claimed now not to have understood the situation before.

But also, I feel like talking to a person on how you cut his privileges is somewhat lack of professionalism, like telling to his face "I don't trust you, so I'm concerned you might want to do something bad". Or otherwise you may be giving a final chance for the person to collect some collateral: "Hey, just letting you know that tomorrow you won't be able to access that classified info, so steal it now if you forgot to do so before!".

Are there known practices or guidelines for this situation? Is the correct approach to discuss with the person or not?

This breaks down to several things.

Yes, discussing something with an employee on the way out is risky, but so is shutting him down without a word.

There are several things that factor in:

• Reason for separation


• Difficulty of transition


• Level of trust

Reason for separation

Is this a voluntary separation, or an involuntary one?

If the person is leaving on good terms, then there's every reason to discuss the transition period, including when access will be shut off? Even if it's involuntary, there's quite a difference between someone leaving due to layoffs and someone being fired. Someone being laid off and not fired for cause may need to transition someone, and if severance is involved, they have quite the incentive to leave on a high note.

The risk in not discussing these things with someone leaving voluntarily or due to a layoff is that you would be showing them disrespect, which then opens you up to sabotage through malicious compliance, and having made an enemy unnecessarily. If you don't trust a person with access to the systems, then send them home with pay for the remainder of their notice period.

If the person is being fired for cause, you want to shut things down the moment he's notified.

Difficulty of transition

A person could be involved in projects where access to critical systems is required for them to wind down/teach a replacement to ramp up to taking over. If this is the case, then you certainly want to discuss termination of access with him. If Joe gave his notice, you'll want to discuss how long it will take for him to transfer his duties to Bob, and how much time it will take. This also goes hand in hand with the "Hit by a bus theory". A friend of mine was let go, they terminated his access, and there was literally no one to handle his work. Oooops. Yes, the people who were responsible were themselves terminated.

Level of trust

This is the big one, and remember, trust is a two way street. If you trust Bob, and Bob has good intentions, why wouldn't you discuss it with him. Personally, I wouldn't want access a day longer than I needed it, because I wouldn't want to be associated with any difficulties, or want to fix it.

The degree of discussions should be directly proportionate to trust.

If you don't trust him, why even have him in the building? If you do, why make him think he's not trusted? Who knows, you may want to hire Bob back if things change, or you may need to consult him on something in the future. A former employee who was shown trust on the way out might be amenable to taking a few phone calls if questions arise after his departure, one who was shut down without any notice might think, "Well, the heck with them then!"

This is a common problem with a common solution. When an employee leaves

1. On their last day, their SSO account is disabled.




2. If the company has any higher security areas not tied to SSO, then the security chief needs to review access and remove the now ex-employee.




3. The security chief should review access to the above areas at least once a month.

If the parting might become heated (i.e. firing), then also

1) Call the person into an office, and tell them to leave their computer. In general, there should be 2 employees in this meeting along with the soon to be fired person. If possible, escort this person to a non-secure area.

2) One of the employees should email, call, or text as soon as the person is away from their computer. You can also begin the firing.

3) Follow the steps above.

4) Do not leave the person unattended until all the step above are complete. If they need a bathroom break, escort them to the bathroom door and wait outside for them.

5) Once you receive the all clear from the security chief + SSO has been disabled, they are allowed to return to their desk, with an escort, and pack personal belongings.

If the employee is trustworthy and has given notice, then it is very appropriate to work on a transition plan together, including setting up new accesses for replacements and shutting down access for the employee who is leaving. This can be a valuable part of the hand-off, making sure that the replacement truly does have adequate access. When the employee is leaving for a new job, unless there were issues with them, this is common.

The problem comes when the employee is being fired or is leaving under bad circumstances. The access still needs to be removed, but it is also important to make sure that all the access points are known, both for removal and for the replacement to have. A discussion is usually not the best way. If the business has overlooked that part of their security, and have that single point of failure, then a discussion or hiring someone to help them find the access points are often the only options.

In the US, often those who are laid-off were trusted and professional employees who would be glad to do a standard hand off of access information, but the current standards is that they are treated the same as firings: remove access without their knowledge, as they are being told of their redundancy.

That is why setting up documentation before hand is always better. It is always better to already know what servers there are and how to connect to them, just in case a key player leaves, for whatever reason.

Telling an employee who's on the way out that you'll be terminating their access to company resources should not be considered any kind of insult. It's standard procedure that only employees with a need for access should have them, and he would be more surprised if his access to critical information were maintained after he leaves. It has nothing to do with trust -- he no longer has a need to access that information, so he shouldn't have the ability.

If he currently has the primary responsibility for the data, his input may be helpful in implementing the transition. If he's leaving on good terms, he'd probably want to be involved in this.

There are lots of good answers here already, but what I have not seen mentioned is application of trust but verify. You do need to have certain degree of trust in your employees, particularly employees with very privileged access (e.g: An IT employee with domain admin privileges). However, you also need to verify that a particular employee is behaving in an appropriate, secure manner.

As to how to verify, upon the termination of an employee, it is best practice to continuously monitor the account of that terminated employee for any activity and such activity discovered should be promptly investigated to determine if malicious activity is taking place. Why unlikely to occur, there is still a risk, albeit how slight, that the terminated employee used company computing resources for unauthorized purposes, such as installing a backdoor to retain remote access.

At my employer, I worked with management to implement additional detection mechanisms, and improve the ones the Information Security team is already using, mechanisms such as DLP software, IDS / IPS, and SIEM. Any activity on the accounts of terminated employees triggers an SIEM alert to our team, and such alert is to be treated as a critical priority, to be either remediated or escalated within a certain SLA. Having such procedures means the importance of trust can be somewhat lessened.

The other answer also mention the need to communicate transitioning procedures to whoever will be taking over the role. Assuming the employee is leaving voluntarily, I agree the transition discussion should be held with the departing employee, but not necessarily to discuss the specific termination procedures, unless departing employee had a need to know such information when employed. Access administration procedures are usually sensitive, and distribution of that information should be based on least privilege. Only individuals with a job need to know such procedures, such as IT Security or HR, should be privy to it. As remote as it may be, excessive details provided to the terminated employee, could possibly be exploited for company harm.