Ufdjrw

A colleague of mine had some very privileged access to sensitive information, that was kept in remote machines with no internet access whose files could not be copied to local machines.

He quit the company for a new job, and there was bit of trouble in the transition when he left.

One point that seemed obvious to me, but other people in the company seem not to agree was:

I believe the severing of his accesses should not have been discussed with him.

Part of this, was because some of his accesses were made through methods that were not agreed upon (pretty sure he was never authorized to do so). And it may not be clear to everyone that this happened. The area's director was informed and took no action in the past, he claimed now not to have understood the situation before.

But also, I feel like talking to a person on how you cut his privileges is somewhat lack of professionalism, like telling to his face "I don't trust you, so I'm concerned you might want to do something bad". Or otherwise you may be giving a final chance for the person to collect some collateral: "Hey, just letting you know that tomorrow you won't be able to access that classified info, so steal it now if you forgot to do so before!".

Are there known practices or guidelines for this situation? Is the correct approach to discuss with the person or not?

EDIT:

I've mentioned that he had unauthorized accesses to a shared machine with sensitive info, which was supposed to be accessible only from computers at the company's VPN. I'm not so sure myself how this came to be, but while one authorized connection to the machine was being severed (and the leaving person was the one who set it up), it was found out that there were at least three unauthorized firewall exceptions. It was also seen at some point that he could remotely access the machine from anywhere and copy sensitive files, which should be impossible even for machines in the company. Hence there was at least this malpractice in his record, even if it does not (necessarily) cause a breach of trust. Also, we do have IT people who are generally responsible for this sort of stuff and have their procedures, but this employee was not with the IT team.

This breaks down to several things.

Yes, discussing something with an employee on the way out is risky, but so is shutting him down without a word.

There are several things that factor in:

• Reason for separation


• Difficulty of transition


• Level of trust

Reason for separation

Is this a voluntary separation, or an involuntary one?

If the person is leaving on good terms, then there's every reason to discuss the transition period, including when access will be shut off? Even if it's involuntary, there's quite a difference between someone leaving due to layoffs and someone being fired. Someone being laid off and not fired for cause may need to transition someone, and if severance is involved, they have quite the incentive to leave on a high note.

The risk in not discussing these things with someone leaving voluntarily or due to a layoff is that you would be showing them disrespect, which then opens you up to sabotage through malicious compliance, and having made an enemy unnecessarily. If you don't trust a person with access to the systems, then send them home with pay for the remainder of their notice period.

If the person is being fired for cause, you want to shut things down the moment he's notified.

Difficulty of transition

A person could be involved in projects where access to critical systems is required for them to wind down/teach a replacement to ramp up to taking over. If this is the case, then you certainly want to discuss termination of access with him. If Joe gave his notice, you'll want to discuss how long it will take for him to transfer his duties to Bob, and how much time it will take. This also goes hand in hand with the "Hit by a bus theory". A friend of mine was let go, they terminated his access, and there was literally no one to handle his work. Oooops. Yes, the people who were responsible were themselves terminated.

Level of trust

This is the big one, and remember, trust is a two way street. If you trust Bob, and Bob has good intentions, why wouldn't you discuss it with him. Personally, I wouldn't want access a day longer than I needed it, because I wouldn't want to be associated with any difficulties, or want to fix it.

The degree of discussions should be directly proportionate to trust.

If you don't trust him, why even have him in the building? If you do, why make him think he's not trusted? Who knows, you may want to hire Bob back if things change, or you may need to consult him on something in the future. A former employee who was shown trust on the way out might be amenable to taking a few phone calls if questions arise after his departure, one who was shut down without any notice might think, "Well, the heck with them then!"

This is a common problem with a common solution. When an employee leaves

1. On their last day, their SSO account is disabled.




2. If the company has any higher security areas not tied to SSO, then the security chief needs to review access and remove the now ex-employee.




3. The security chief should review access to the above areas at least once a month.

If the parting might become heated (i.e. firing), then also

1) Call the person into an office, and tell them to leave their computer. In general, there should be 2 employees in this meeting along with the soon to be fired person. If possible, escort this person to a non-secure area.

2) One of the employees should email, call, or text as soon as the person is away from their computer. You can also begin the firing.

3) Follow the steps above.

4) Do not leave the person unattended until all the step above are complete. If they need a bathroom break, escort them to the bathroom door and wait outside for them.

5) Once you receive the all clear from the security chief + SSO has been disabled, they are allowed to return to their desk, with an escort, and pack personal belongings.

EDIT:

Several commenters have mentioned this seems extreme, which I don't understand at all.

The first 3 steps (hopefully) what every company does when someone moves on. Ex-employees shouldn't have access to their old work-place once they leave. That's a danger to bo the employer, and the employee. (What happens if there is a theft)

The "firing" steps are pretty normal too. Even if it's a layoff, people will get emotional, and some of them may lash out (like live-tweeting the event).

Hopefully, it will only take a few minutes to turn off SSO, and revoke access. It should not be a 30-minute ordeal.

Telling an employee who's on the way out that you'll be terminating their access to company resources should not be considered any kind of insult. It's standard procedure that only employees with a need for access should have them, and he would be more surprised if his access to critical information were maintained after he leaves. It has nothing to do with trust -- he no longer has a need to access that information, so he shouldn't have the ability.

If he currently has the primary responsibility for the data, his input may be helpful in implementing the transition. If he's leaving on good terms, he'd probably want to be involved in this.

If the employee is trustworthy and has given notice, then it is very appropriate to work on a transition plan together, including setting up new accesses for replacements and shutting down access for the employee who is leaving. This can be a valuable part of the hand-off, making sure that the replacement truly does have adequate access. When the employee is leaving for a new job, unless there were issues with them, this is common.

The problem comes when the employee is being fired or is leaving under bad circumstances. The access still needs to be removed, but it is also important to make sure that all the access points are known, both for removal and for the replacement to have. A discussion is usually not the best way. If the business has overlooked that part of their security, and have that single point of failure, then a discussion or hiring someone to help them find the access points are often the only options.

In the US, often those who are laid-off were trusted and professional employees who would be glad to do a standard hand off of access information, but the current standards is that they are treated the same as firings: remove access without their knowledge, as they are being told of their redundancy.

That is why setting up documentation before hand is always better. It is always better to already know what servers there are and how to connect to them, just in case a key player leaves, for whatever reason.