Terminated employee cost company hundreds of thousands of dollars because nobody revoked access

PWNED Welcome back to PWNED, where we talk about organizations that are independently self-owned. This week’s tale of toxic tech involves a disgruntled ex-employee who had the means and opportunity to wreak havoc. Our story comes courtesy of Yad Senapathy, who serves as CEO of the Project Management Training Institute in Dallas …

[Mishak]

Better still...

Revoke access before they are told they are being terminated.

[Anonymous Coward]

Re: Better still...

I've spent years trying to get the higher-ups to involve IT at an earlier stage so this sort of thing can be avoided. It doesn't work. I still get the occasional "oh, that person hasn't worked here for 6 months" but more commonly people are dismissed on a Friday and nobody tells us until the Monday or later.

[Anonymous Coward]

Re: Better still...

Same here.I've just been asked to create an account for a user in a certain role.

I asked if this was an additional member to the role because xxx.yyy is down as doing that job.

"Oh, they left in July" was the reply.....

[big_D]

Re: Better still...

At one employer, they let the CEO of a subsidiary go, nobody informed us. It was 3 months later, when I tried to contact him about a matter regarding his staff that I got an out of office reply that he had left the company! VPN active, M365 active, AD active, email not being redirected...

[Anonymous Coward]

Re: Better still...

Aren't CEOs of a subsidiary normally given a 'special project' advising on future strategy, to fully leverage their outstanding knowlege of the industry and further enhance shareholder value in the current dynamic macro envirnment and complex headwinds?

Longer ago, blocking a CEO's access was much easier - just tell his PA or secretary not to send any emails and to stop printing any important received emails.

[Yet Another Anonymous coward]

Re: Better still...

Yes but it got messy "revoking" the secretary

[big_D]

Re: Better still...

No PA, and no share holders, family run company. The decided he wasn't a good fit after a few weeks and kicked him out.

[YetAnotherLocksmith]

Re: Better still...

He probably still wanted to do things and make things happen, not realising that now there were 45 layers of management to say "no".

[Anonymous Coward]

Re: Better still...

I was made redundant from a role, sorry my role was made redundant and I was leaving a firm. I had a unique role that was to be split amongst other people because I was from the original company before it merged and was being paid too much for the new company to stomach. They were not requiring anybody to work their notice period, you could just leave and they’d pay you for the time. So I was told it’s goodbye and then 3 minutes later told that they still needed me to do training on my job functions for the unlucky SOBs who were taking it on. I negotiated 12 months of keeping my corporate email account to stay (paid) and do that for a few days. HR said it was fine and the department head could authorise that. At first however IT Support objected vociferously against this and said it breached X,Y ans Z rules and then they found out who it was getting the continuing email. I was popular with them and they said okay but it will have to be be stripped of any email groups, so no companywide emails etc.

Then the Director Of Technology got wind of this and said no way, IT made the case for me and it was allowed. However he insisted that a non removable disclaimer was added to my outgoing emails informing the recipient that I had left the company and any content sent was my personal responsibility and that the company was not liable for anything I wrote. I was fine with that as it happened but was amused when someone else tried the same thing about a year later when they left voluntarily and asked to keep their email. They were not so popular, and it was request denied in their case.

[Anonymous Coward]

Re: Better still...

Standard practice should be that they get called into the "Don't come back Monday" meeting, and while they are in that, their access is being revoked by the IT team.

I've had it the other way around. At a previous employer I was off on sick for a few months and found my access "restricted". Being a key IT person, I knew the processes normally employed (standard practice was pretty well the bad practices highlighted by the article and previous comments) so was able to flag up to my union rep that they clearly didn't plan for me coming back - others on sick (and then taking early retirement on health grounds) didn't get that treatment, so the difference was stark. And as expected, it turned out they wanted to reach an agreement (pay me off) which given the dire state of the company and they'd brought in hatchet beancounters to run it was no surprise. Painful at the time, but in hindsight a great kick in the backside to move whilst getting paid for the privilege.

[druck]

Re: Better still...

I'd just handed in my notice, and on Monday morning was going up in the lift with the IT guy (don't know why as I normally only ever take the stairs) when he said "I didn't expect to see you, I'm just about to revoke your access", I said "hold on, I'm leaving on this date in September, not August", he said "you'd better get your manager to stop it then". I ran off to my desk only to find my manager was on holiday that week, and so was his boss, and no one else on the site knew anything about my leaving date. IT probably shouldn't have, but gave me the benefit of the doubt and didn't close my accounts, but I did wonder if I should bother turning up for the next 2 weeks, as I didn't know I was being paid. Luckily it was all sorted out when the bosses got back, and I did get paid.

[Dave K]

Re: Better still...

During the meeting is the answer. I've done this - got called over to HR (as if it was a standard "IT" issue), only to be told to disappear for 10 minutes, then return to my desk. An adjacent employee would be missing by then as they would be in the dreaded HR meeting. My task was to revoke all access, terminate VPN access, change all "admin" passwords and everything like that.

Some of these Pwned stories frankly beggar belief that organisations can be so lackadaisical with regards to security around the termination of senior IT employees.

[Anonymous Coward]

Re: Better still...

i remember having to change passwords of last resort every time someone left, is a right pain when you have thousands of devices to change the password on and confirm its done, thankfully automation takes care of things till those mysterious times it doesn't work.

Password of last resort is the type of thing that is used when the system can't use the network based auth systems so not always used but would be used in the event of some systems outage somewhere.

[The Oncoming Scorn]

Re: Better still...

On a deployment\refresh project for a Royalist Car Club, we got sent as a team to a desk cluster (or two) immedietly, as the ladies manning the phone were currently in a meeting losing their jobs & we were to remove all computers & monitors NOW!

[Yet Another Anonymous coward]

Re: Better still...

> Royalist Car Club

Presumably they don't fix Cavaliers ?

[Claptrap314]

Re: Better still...

So long as the systems in question ARE connected to the network, those passwords of last resort must be synced to the golden copies. In the case of a departure ("voluntary" or not), you perform a forced sync.

[Anonymous Coward]

Re: Better still...

I'm impressed.

I've never yet worked at a company that had a working policy to change the network device last-resort pwd's when someone leaves. Some very big enterprises , isp's and nsp's. 30 year career.

and before you ask, operational auth never my responsibility. am now upper arch level so so don't need know the last resorts..in fact can't remember last time I logged into a prod box.

[phuzz]

Re: Better still...

At my last job, I was the sole It person, so I had to carefully list everything I'd had access to, so the part-timer they'd replaced me with could change the passwords. Luckily for them it was my choice to leave and I was happy to help.

[CrazyOldCatMan]

Re: Better still...

At my last job, I was the sole It person

Two Orks ago I was the IT manager. I handed in my notice (my manager was being a dick) and carefully coached the guy who was taking over from me what he needed to do:

Disable my accounts (AD, website CRM, webserver SSH login) etc etc.

I provided documentation on how to do it - screenshots, machine names etc.

Three months later they contacted me to see if I could do some consulting work since the IT environment was falling apart. I said no (for many reasons including being in the middle of settling into my new job) especially as they would need to create new accounts for me and I really didn't want the hassle.

"Oh no" they said "all your accounts are still there because xxxxxx says he doesn't know how to disable them.."

Which made it a hard no - they wanted me to go back in order to be their IT manager again, while still doing my new job.

The company doesn't exist any more.

[BartyFartsLast]

Re: Better still...

That's a shitty thing to do, but we, by default, lock a user's account while they're on long term sick leave, we might unlock it if there's a desperate need for them to access stuff but in general they're not expected to be working whilst recovering

[anothercynic]

Re: Better still...

That does make sense - Once they return to work, even on a 1-day-a-week basis, you can re-enable the account, and you know the user is not a security risk for whatever reason.

[Yet Another Anonymous coward]

Re: Better still...

> they're not expected to be working whilst recovering

Tell me you're not American without telling me you're not American !

[MachDiamond]

Re: Better still...

"That's a shitty thing to do, but we, by default, lock a user's account while they're on long term sick leave, we might unlock it if there's a desperate need for them to access stuff but in general they're not expected to be working whilst recovering"

Sometimes it may be better to just limit access. Yes, the person is recovering and not expected to do any work, but it might be helpful if they can still stay up to date so when they come back, they aren't spending the first month catching up on the status of things.

[Yet Another Anonymous coward]

Re: Better still...

>lock a user's account while they're on long term sick leave

With new cloud services your Microsoft services can be linked directly to their medical monitors. As their EKG deteriorates they can be promoted to management

[UCAP]

Re: Better still...

Becoming a CEO once the monitors indicate complete brain-death.

[Yet Another Anonymous coward]

Re: Better still...

Yes, got EEG and EKG mixed up - cos Heart starts with a "K" obviously

That's why I'm not a brian surgeon

[NetMage]

Re: Better still...

I think you meant because Cardio starts with a K.

[Antron Argaiv]

Re: Better still...

EEG, surely?

[CrazyOldCatMan]

Re: Better still...

in general they're not expected to be working whilst recovering

In the UK my understanding is that, if you are signed off sick, you cannot be working.

For no other reason than your employers liability insurance doesn't cover you (there are lots of other reasons.. being signed off sick means you *can't* work - or should do)

[I could be a dog really]

Re: Better still...

being signed off sick means you *can't* work - or should do

Not actually correct.

First off, there is no longer a "sick note", for some time it's been called a "fit note" - though in reality it's the same thing.

But, here's the important bit, when signing you off, it isn't a simple "fit for work/not fit for work<period>" choice. There's scope for saying (effectively) not fit for routine work but may be fit for other work. For example, a manual worker who's had a minor injury that means they aren't fit to go digging holes in the road or lugging heavy sacks around a warehouse could still be fit enough for lighter duties - so while others lean in and handle the heavy manual work, they could be reassigned a less manual job (e.g. manning the counter in a building supplies business.)

In my case, I've had extended periods off work, but have been "OK" enough to periodically log in and delete some fo the email cruft - and try to deal with the HR people who are refusing to deal with the reason I'm off because while I'm off I'm clearly not fit enough to deal with that, even after repeatedly pointing out that their failure to deal with it is the only reason I'm not back at work yet !

[Aladdin Sane]

Re: Better still...

So they can lose their shit before being told?

[big_D]

Re: Better still...

Yeah, before is not on, but IT should be informed beforehand, so that they can revoke access during the meeting. Just in case.

[big_D]

Re: Better still...

I had to terminate an admin last week. I didn't know about it, until I was sitting in the meeting with him and HR. The head of HR said, "we'll play it by ear," then was talking about letting him go after 5 minutes in the meeting... I was scrambling to get things deactivated and passwords changed as they were sorting out the paperwork.

But usually, the HR department doesn't seem to find it important to inform the IT that employees have left the company, so their AD and M365 is often still active weeks later. Being Head of IT and letting one of my admins go, I was, luckily in the thick of it and could react instantly.

[Cav]

Re: Better still...

Yes, I saw that at one place I worked. People would try to login and receive a message indicating that their access had been revoked and that they should go see HR. Not a pleasant way to find out.

[The Oncoming Scorn]

Re: Better still...

Yeah had that once at a place, order came in from HR via email, to disable a employee's account.

Less than ten minutes later he rang in saying his account is disabled.

I was forced to tell him he needs to speak to his manager as a matter of urgency.

[Yet Another Anonymous coward]

Re: Better still...

Wasn't there an el'reg story about a quant/programmer at a merchant bank ?

Turned up on Monday and his entry badge wouldn't work, so he thought "Ok go home and hit up linkedin"

A couple of days later he gets a frantic "Where the F are you ?" call from his manager, "Interviewing at a new job" he replies.

He wasn't fired, the badge system had simply fscked up

[Antron Argaiv]

Re: Better still...

Happened to me last week. Got my badge, got my laptop, started setting it up with the IT guy, and couldn't log in. "Account locked"

After about an hour, IT guy comes back and says it's some HR new hire paperwork that didn't get done. My manager was out that day, so nothing could be fixed. I went home and the next day they told me to try again, and it worked fine. Nice to know the system works, but it cost me a trip into town. At least I managed to set up the laptop at home the next day.

[I could be a dog really]

Re: Better still...

Yeah, the onboarding and actually get everything working stage can be "interesting"

[Marty McFly]

Re: Better still...

I got that shortly after Y2K. Five year annual review. You are doing great! Your job is going to Atlanta, you are not going with it. Let's go get your stuff.

IT had already hard-powered off my desktop PC. I grabbed a screwdriver and started taking it apart. They objected until I pointed out the sound card I had installed AND labeled as personal property. All the employees were called into a meeting elsewhere and they tried to shuffle me out the side door. I insisted on walking out the front door past the meeting room window with my head held high.

A week later my replacement was begging me for the document password I had on the spreadsheets. He was a good guy and it wasn't his fault, so I gave him the passwords. Tragically he had untreated hypertension and died young a few months later. I doubt the stress of doing multiple people's jobs was beneficial to his health. A beverage in remembrance.

[MachDiamond]

Re: Better still...

"Revoke access before they are told they are being terminated."

In the movie Head Office, it was the furniture movers that knew about terminations before anybody else. People would see them coming and shit themselves.

If somebody is being terminated, there should be a process in place. Since HR doesn't do much else, it should be on that department to sort out. Company devices, accounts, credit cards, access cards, keys and login credentials.If the person is to be frog-marched out, there should be security or a senior person that shows up with the cardboard box and supervises the former employees packing up.

IT likely knows how the termination is going down, but I still can't blame them for waiting for instructions about removing access. There could be a big difference between somebody being put on leave with a possibility of returning versus a firing with prejudice.

The last "real" job I left (my choice), I had to walk them through the process. I left a folder with software registration information, a calendar of renewal dates and how they had been paid for in the past. I made a checklist of keys and access credentials that I was turning in and made the CTO sign off that he received them to CYA. It was not a great place to work so things that should have been captured so somebody else could carry on with them weren't always documented leaving the door open for some well-compensated consulting work (never came). The documentation I left behind that was directly associated with my primary role did get me some consulting when the company was bought out of bankruptcy some years later. It was finally noticed that I did show my work and the new owner appreciated the quality of that documentation.

[PB90210]

Re: Better still...

The big sign for us of an upcoming move/reorg was who they sent someone to replace broken/missing ceiling tiles... one time it was to fit new window blinds...

[bemusedHorseman]

Re: Better still...

Arguably, "hey, why does it say my username no longer exists?" should be how they find out about being fired, at least in cases where the user is likely to go scorched earth the moment they smell something funny. A sufficiently pissed-off nerd with admin privileges can still do some big damage in the time it takes you to say "HR wants to see you" (even doing it right in front of you), so if you preemptively revoke their access while they still think it's business as usual...

[MachDiamond]

Re: Better still...

"Arguably, "hey, why does it say my username no longer exists?" should be how they find out about being fired"

In one of the rounds of redundancies at Tesla, employees found out when the showed up for work and their access card had been de-authorized. Not a good place to work, or be fired from. Many commuter trains and other public transportation can be heavily slanted in one direction in the morning and the other in the evening so returning home might take hours to return home.

[Anonymous Coward]

I retired from the UK but of a major international company a few years back. They were heavily it involved, so I was surprised that, for about 3 months:

I kept being paid

My keycard still worked

I had full remote access to their IT services.

Sadly, I had to return the overpayment of salary. I assume my keycard was eventually revoked (immaterial now, as the office has since moved). I also assume my emote access has been turned off (I have forgotten my credentials now anyway and have very likely fallen foul of several enforced password changes).

Muppets.

[Bebu sa Ware]

Muppets

I suspect Miss Piggy and Kermit could actually do better.

[abend0c4]

I resigned from a major public sector organisation in London, received no acknowledgment and left on the day I had indicated to them but continued to be paid for a further six months (also, eventually, requested back). But there were also people on the staff who arrived at their desks at 9am and then left for nearby establishments, returning at 5pm to collect their coats and go home so I'm assuming that not only were they unclear about who they employed but also about why. That ongoing loss of public money is entirely invisible to the books.

[MachDiamond]

"but continued to be paid for a further six months "

When pay was received in the form of a check, it would be easy to just stick them in a folder. With direct deposit, it's more of a pain since trying to reverse the transaction with the bank will only lead to gasps of astonishment and questions. The only thing to be done is convert the money into something on paper to cache in a folder and close the account so somebody will take a notice when the transfer fails.

[David Hicklin]

"but continued to be paid for a further six months "

How the heck does that get squared with the tax man ??

[abend0c4]

It was some time ago and I don't recall the exact details, but as they hadn't issued a P45, the error was corrected within the same tax year and I hadn't wanted to repeat the experience of employment it wasn't as complicated as it might have been. I never really resolved the issue of whether I was over-credited with pension contributions and they clearly didn't want to pull on that thread.

The department HR rep had left just before me and I suspect they may not have noticed that either, exacerbating the chaos.

[MachDiamond]

"How the heck does that get squared with the tax man ??"

Good luck with that.

[elsergiovolador]

How did you know your keycard worked? Were you going to work after being let go?

[You aint sin me, roit]

If it was TfL..

They had a "known problem" about rescinding employee cards.

[Yet Another Anonymous coward]

Re: If it was TfL..

Back in the dim mists of time they had a "known problem" with their season ticket cards. You could use anything with a magnetic stripe, from a library card to a parking pass to go through the gates.

In the end they had to have an inspector by the gates at every London station for a few days, "inviting" people that got caught to buy a season ticket.

[John Sager]

When I retired, on my last day I went to the main office of our group to say goodbye, then I went back to my office to get my bag and my access card has already been deactivated! I had to borrow the boss's card to get in...

[The Oncoming Scorn]

Leaving one overzealous place, I'd been out on a field job most of the day & was rushing through my final timesheets\expenses & missed the mass exodus at 5pm for the door.

My keycard was deactivated & wouldn't let me leave.

[MachDiamond]

"My keycard was deactivated & wouldn't let me leave."

That's what fire doors are for.

If I had to call somebody to let me out, there'd be a charge for that wait. I see why it's convenient to have people "badge out", but if that's required to exit the building without setting off alarms, there's a problem in somebody's thinking.

[YetAnotherLocksmith]

No, it's not. The problem is that they can't egress. The alarms should sound because they didn't badge out, that's what should happen, but the exit door should open regardless.

[MachDiamond]

"The alarms should sound because they didn't badge out, that's what should happen, but the exit door should open regardless."

Not badging out can be dealt with in other ways. Some companies might track hourly employees that way so if they don't badge in or out, they'll need to go visit HR <shudder> and have a chat about company policy which will be noted in their file to be brought up at the next review. That might also screw up their pay for that period which may take another couple of periods to straighten out.

[CrazyOldCatMan]

My keycard was deactivated & wouldn't let me leave.

Illegal in the UK. Ability to exit is not allowed to be tied to security access..

[MachDiamond]

"Illegal in the UK. "

You'd think somebody at a company would take notice of that, but that's why the word "hope" was invented.

[DS999]

I'll you could have kept

That overpayment of salary. If it was in the form of direct deposits that's on them for not handling it. If they were mailing you paper checks it would be harder to argue the fault is all on their side since you'd be knowingly cashing checks you knew were sent in error.

I would certainly have talked to a lawyer before returning that money. If it was a small business that's one thing but you said "major international company". Sorry, not sorry, if you guys keep paying me in error I'm keeping it unless my lawyer advises me that if taken to court I'd lose.

[Yet Another Anonymous coward]

Re: I'll you could have kept

All they had to do was going through your official payroll procedure to recover the money.

The one that's only slightly less complicated than dealing with ADP, Oracle and SAP

[DS999]

Re: I'll you could have kept

Maybe they could take it back from his account I'm not sure about the legalities there. But if he had already spent it or otherwise moved it out of that account?

It could also really mess up his taxes if they pull the money out but don't reverse the information filed with the IRS (or his equivalent) as he'd owe taxes on money he never received. Even if they are legally entitled to recover that money I would require a full accounting of exactly what they filed for those erroneous payments and what steps they are taking to insure that everything is corrected with the federal and state/local tax authorities. Plus a written contract that if you do run into issues when filing your taxes that they will fully cover all your CPA and if necessary legal fees to untangle the mess. Plus cover my legal fees for talking to a lawyer to put together that contract and any other legal expenses determining my options when they came by and said "oops we need to take back this money!"

Then there are other possibilities like if this happens around the end of the year so the "undoing" of it takes place in the next year then you have higher earnings reported that year which could impact stuff like your kid's financial aid or scholarships for college. Its one thing if you got to keep the money, but if you are erronously reported as making more money one year because of the error and it is corrected in the following year you are worse off than if they hadn't screwed up. They gotta commit to making stuff like that right, should it happen.

If you handle this properly they might decide it is cheaper to let you keep a few months extra pay than is to undo everything and be on the hook legally for your expenses. Because they can't just pull the money and say "you're on your own if it causes any problems for you". I would sue them so fast it would make their head spin if they tried.

[Anonymous Coward]

Re: I'll you could have kept

I worked for a bank that kept paying me for 3 months after I left. They only realized their mistake because I emailed my old boss and told them they should really stop paying me.

A couple of weeks later I got a letter through the post asking me to sign a form to allow them to recover the money from my bank account.

I tossed it in the bin.

Then I got a second letter asking the same thing.

I tossed that one too.

Never heard any more about it after that.

[YetAnotherLocksmith]

Re: I'll you could have kept

I presume it was a different bank to where the account was, otherwise that's brave!

[YetAnotherLocksmith]

Really you could have kept it

You could've written back and said you'd spent it all on lawyers to find out that yes, you could keep it, and pre paid them ready.

[MachDiamond]

Re: I'll you could have kept

"I would certainly have talked to a lawyer before returning that money."

Wow, you must be making a mint! to make talking to a lawyer worthwhile.

If you could send paper checks back, somebody might notice. Trying to reverse a direct deposit is too much work and less likely for anybody to notice.

If something like this were to happen, it would be good to keep a time card on every minute spent dealing with it and any costs. If you have to get a title loan on your car to be able to talk to a lawyer, you'd want to be compensated.

[Anonymous Coward]

High risk terminations

High risk terminations should always be flagged and handled by a specific team to make sure everything is done in a timely manner, legal holds put in place and all devices recovered. Any system admin is automatically a high risk term.

I did read a (possibly apocryphal) tale once of a sysadmin fired for misconduct. The sysadmin had way too much access to terminate cleanly and quickly, so they were invited to a meeting that involved a long flight and hence no access to mobile devices. Once the sysadmin was in the air the IT team started working though all the accounts the sysadmin had, when they landed at the other end they were fired at the airport for gross misconduct and the company even cancelled their return ticket.

[Philip Storry]

Re: High risk terminations

I can believe the story right up until "even cancelled their return ticket"...

I doubt that would be thought of as legal in most jurisdictions. It's an undue burden on the employee, and you're just opening yourself up to a lawsuit. It will almost certainly not go well for the company - they've just stranded someone on purpose. Most courts will be favourable to the employee in such a case.

I'd have said that they can use the hotel for one night, then fly back on a re-arranged flight. I'd even have offered support in arranging that, so that the employee can't claim any kind of prejudice should they sue.

Otherwise, though, it's an ingenious way to get the time that they needed to do the work.

Hopefully someone was then tasked with creating a run sheet and some scripts to speed this kind of thing up in future. ;-)

[Bebu sa Ware]

Re: ingenious way to get the time that they needed to do the work.

A well lubricated night on the town might have been cheaper. A three day bender would give you plenty of time.

[Anonymous Coward]

Re: ingenious way to get the time that they needed to do the work.

POETS used to be a useful time to do this, I remember terminating access for someone while everyone was at the pub. he came back in time to leave and was met by HR.

[Anonymous Coward]

Re: High risk terminations

Or just go through that process during his return flight and save the legal nightmare.

[Yet Another Anonymous coward]

Re: High risk terminations

Get up in a crate, Perkins, pop over to Bremen, take a shufti, don't come back

[Diogenes8080]

Re: High risk terminations BOfH style

I misunderstood "long flight" at first, thinking at least 12 floors must be involved.

[NetMage]

Re: High risk terminations BOfH style

This isn’t BOFH.

[Philip Storry]

Expiration dates can help

At my current employer, all of our freelancers/contractors have an expiration date set when they are created in Active Directory. That date is amended if their contract is extended - but only when Finance tell us that the contract has been signed.

This works well for contractors, as access simply stops at the end of their employment. It does mean we need to audit the old freelancer accounts (via a script interrogating AD) monthly to find old accounts and handle them as leavers, because we're often not notified that the contractor has "left", but it's a reasonable enough system.

I've often wondered why we can't just do the same for employees. HR knows who we employ. We could ask them for an export from their HR system which shows current employees. Then set the expiration date to, say, three month's time. Make the process a monthly event, and now eventually all leavers will expire unless HR give us the wrong details. A three month grace window is enough to not cause immediate access issues, and hopefully also long enough to spot any problems with the data and resolve them.

Of course then we'll probably find out that the senior management and directors have a different review/pay system for some reason so they're not on the HR list provided, and suddenly the plan results in locking out senior management. (With an appropriate productivity gain for everyone else during that week, no doubt.)

None of this helps with the "this person is leaving, lock their accounts)" problem - that requires communication and coordination. But the use of expiration dates, if your system supports them, would go along way to reducing leftover accounts.

The only other method is extensive and regular auditing... *shudders*

Also note the caveat about expiration dates - "if your system supports them". Google Workspace doesn't. AWS IAM doesn't. In fact quite a lot of systems don't. This is almost an industry-wide problem. You can try to fake the functionality it by setting password expiration policies on accounts - so perhaps having a Leavers OU in Google Workspace, or a script which does this to tagged accounts in AWS IAM...

I'm old enough to remember when my credit cards were valid for something like seven to ten years, before fraud meant that they reduced the time limits down massively. Expiration dates are a well known security technique in the physical identity world that has been used for decades. They're not the answer in and of themselves, but are one of the many layers of defence. So quite why we don't demand them in the IT world is beyond me...

[Anonymous Coward]

Re: Expiration dates can help

Okta used to be particularly good at this (been a decade since I’ve last deployed it), and paired with something like Zscaler, allowed for very fine-grained access which could be immediately frozen if needed. I’m sure there are many more options nowadays (and, hopefully, cheaper!).

[Yet Another Anonymous coward]

Re: Expiration dates can help

I think IBM have a patent on expiring workers when they reach a certain age.

[spuck]

Re: Expiration dates can help

At a previous job, our domain accounts would lock themselves every XX days (60? 90?). I'd always assumed it was due to the high turnover we had in some areas of the company, like the incoming customer service department.

It was such a routine thing, that calling the IT helpdesk line the first option after the automated greeting was "To unlock your account, press 1".

After pressing 1, you were then prompted to enter your employee number, then the last 4 digits of your social security number. There would be a brief pause (I'm assuming while a HR database was queried), and then you'd be told "Your account has been unlocked." and returned to the root of the phone tree menu.

I'd always thought it was a pretty lazy way to go about this... why couldn't they just run a nightly job run and lock any account not tied to an active employee record? But I suppose this approach would also identify and disable any unnecessary accounts... there were probably employees on the payroll that had accounts automatically set up when they were hired, but worked in the machine shop, cafeteria, etc. which never actually needed to log into any system. This approach would disable those accounts which existed but were really never needed.

But those were simpler times, when it was possible to be gainfully employed in many jobs without ever needing to read or send an e-mail, record a timesheet on a webpage, etc...

[Great Southern Land]

Re: Expiration dates can help

>>>It was such a routine thing, that calling the IT helpdesk line the first option after the automated greeting was "To unlock your account, press 1".

Some of the people I've worked with would have needed that sequence programmed into a speed-dial on their desk phone.

Then of course there's the security risks (Hack someone's account, trigger "too many tries" lockout, call IT, hit speed dial, hack again.....)

[Anonymous Coward]

Re: Expiration dates can help

I was a long-term contractor at a previous workplace. Was there 14 years. Our employment was technically for 2 years, but with possibility of renewal. Every 2 years, the (customer) manager in charge of our contract would be late in approving the renewal - and a couple dozen workers would be locked out, all on the same morning.

Security was quite understanding (probably because they were contractors too; half the folks on site were long-term contractors), understood what was happening, and consistently let us in to do our jobs until the mess could be sorted out.

So, expiration dates can be a good thing, **IF** the folks who approve the extensions stay on the ball about it.

[MachDiamond]

Re: Expiration dates can help

"Google Workspace doesn't. AWS IAM doesn't."

That's an issue with outsourcing. It's all very handy to let them have control over your paperwork rather than doing it yourself, but you then have to do it their way and other bad things can happen.

The small aerospace company I worked for explored an outsourced system and luckily it would not be allowed due to ITAR and government contract reasons. It wasn't that difficult to keep all of that in-house. Several of us set up a workflow in a couple of afternoons and did training on it the next week. The couple of people that fought back and just did it their own way got a talking to. Everybody doing it their own way was the problem.

[Anonymous Coward]

Re: Expiration dates can help

> HR knows who we employ

Really? That's stretching it for most HR orgs I've seen.

[Bebu sa Ware]

At more than one site…

accounts were left active simply because the exiting staff member's personal account(s) was(were) effectively role based account(s) which an unknown number of other staff (and I daresay applications too) used as an essential part of their jobs. Not even the password(s) could be changed without the possibility of the sky falling.

Fortunately no hostile termination in my shorts times I was employed in these dismal environments.

Even though those sites were a long time ago now I don't doubt there are still sites that demonstrate the same insanity.

[Yet Another Anonymous coward]

Re: At more than one site…

Have had to call up previous employee to get them to give me a 2FA code to change a password on an account that was tied to their cell number.

Startup life - be nice to people, it's a small world and you never know when you might meet/need them again

[Anonymous Coward]

Access Continued on Purpose

I retired from an organization where i did various computer systems work, while the big cheese of tech in the organization saw to it my accounts on major systems were terminated, I was asked to allow them my logins for several social media accounts used officially by the organization because no one wanted to take on the hassle of transferring the controlling accounts with the platforms to a new person. It was several years before they eventually got around to do that during which time I could still long as the admin of those accounts.

[Anonymous Coward]

people who do this are not professionals. they don't deserve employment.

[Jimmy2Cows]

Crime

Would have been nice to know if said disgruntled former employee was prosecuted for their criminal actions.

Presumably they're now enjoying the grace of the American justice system, stamping out license plates to pay off the cost incurred plus punitive damages.

[Anonymous Coward]

Re: Crime

A few years ago I worked in a fairly niche sector where more or less everyone knows everyone else in the industry.

A certain employee had their contract terminated following complaints from several large customers regarding the quality his work. In line with his contract he was given four weeks notice but told that he should leave on Friday i.e. 3 weeks gardening leave. He used the his company account to email numerous customers to inform them that he was being unfairly dismissed and what a bunch of morons his bosses were.

This backfired spectacularly as the IT department were monitoring his emails and revoked his access to external accounts after a few hours. His emails were downloaded by the IT team and forwarded to the company senior management. He was then sacked on the spot for misconduct and lost his months pay plus outstanding holiday pay.

He had the ignominy of being escorted from the building by two security men in full view of the open plan office and being searched for company property as he left the building.

He was then unofficially blacklisted by the majority of companies in the sector and a number of the recruitment agencies.

To my knowledge he is working on contract (ir35) at the coal face rather than the senior position he once held.

Karma can be a real bitch.

[Anonymous Coward]

Re: Crime

Blacklisting should carry far more serious sanctions than it does.

Jail time for top bods in the company would be a good start at stamping it out

[Anonymous Coward]

Re: Crime

No chance, 'Bomb them all Pete' was given a pardon by the great OrangUtan.

[Elongated Muskrat]

The message fromt his article:

Anyone who uses the term "offboarding" should be "offboarded" from a short plank into shark-infested waters. The same goes for "onboarding". We should have zero tolerance for the corporate-speak mangling of the English language; if you're sacking someone call it that, don't sugar-coat it in weasel-word euphemisms.

[Aladdin Sane]

Re: The message fromt his article:

Where do you stand on waterboarding such individuals?

[Anonymous Coward]

Re: The message fromt his article:

Unless you are CIA, this is called torture instead of “enhanced interrogation technique”

[Aladdin Sane]

Re: The message fromt his article:

Me? CIA? Perish the thought. I'm definitely not CIA. No sir.

[Excused Boots]

Re: The message fromt his article:

Ah so you’re with the NSA then.

[The Oncoming Scorn]

Re: The message fromt his article:

Flowers

By

Irene.

[MachDiamond]

Re: The message fromt his article:

"Where do you stand on waterboarding such individuals?"

That's when they start with the company.

The first time I heard "onboarding", "waterboarding" was the first thing to come to mind. More mindless biz-speak, a pet peeve.

[Aladdin Sane]

Re: The message fromt his article:

I work in the finance sector. I hear "onboarding" and I think Crimson Permanent Assurance

[Yet Another Anonymous coward]

Texas has changed

"The angry worker logged back in, then deleted files"

What's wrong with returning the next day with his Assault Rifle of Constitutional Freedom and going postal?

I blame all this tofu they're putting in the chemtrails

[ecofeco]

Re: Texas has changed

LOL, I see what you did there.

[Eric 9001]

Re: Texas has changed

The thing wrong is how in the land of the nonfree, you can't have assault rifles (only the government can have them - despite how the government has done things far worse than the most disgruntled postal worker).

Btw, civilian AR-15-style (ArmaLite-15-style) rifles are not assault rifles, as the select-fire capability is removed - but meanwhile the government can have as many ArmaLite AR-15 assault rifles as they want (seems certain Irish liked their ArmaLite's too (and managed to acquire plenty via organised crime)).

[CrazyOldCatMan]

Re: Texas has changed

(and managed to acquire plenty via organised crime)

Not the first time I've had Noraid called that..

(For the young an innocent, Noraid is a USA organisation that explicitly supported the Provisional IRA and supplied them with weapons and bomb making materials. Even the US government of the time accused them of doing so.

Which prompted Giles the cartoonist to draw the following:

https://archive.cartoons.ac.uk/GetMultimedia.ashx?db=Catalog&type=default&fname=GAA394804.jpg

(Context is the Brighton bombing of the Conservative Party conference and a prototypical New York Irish woman exclaiming "Oh Elmer - to think it might have one of our very own little bombs!")

Of course, it being a USA organisation actively supporting terrorism, nothing was done about it. It's still around but has morphed into a USA wing of Sinn Fein. Who were not terrorist at all, honest.

(Yes, I'm aware that some of the current Sinn Fein have nothing to do with the IRA but a lot of their early leaders most definitely did, even if they turned to a political path later)

[YetAnotherLocksmith]

Re: Texas has changed

I'm reminded of that Family Guy skin colour chart...

[BartyFartsLast]

We have a system that letsamagers schedule access revocation and account lockouts if it's a "nice" parting, it's always for COB on their last day in the office, but occasionally the managers fail to follow process when it's a short notice thing and those are the worst because someone who's been booted is never happy.

[MachDiamond]

"it's always for COB on their last day in the office,"

"Chief of the Boat"?

[Yet Another Anonymous coward]

Same as EOD but less explosive ?

[Stuart Castle]

It's standard practice to revoke access to IT systems when terminating staff. Hell, we were taught this at college. A disgruntled employee who has just been fired can do an awful lot of damage.

At the company where I work now, a few years ago, they fired my boss. All I know is one friday night, my colleague (who was a system admin) was supposed to come to the pub at 5pm. He didn't arrive until 7, when he explained that the company had fired my boss (who was also his), and he'd had to disable alll the bosses accounts, and swipecard access. We have a script that does this for normal staff, but he was at senior manager level, and had admin access to a lot of systems. He was in a position where he could do a *lot* of damage if he had half a mind to. As well as my colleague personally ensuring all the his access to our various systems was removed, he was also escorted to his office (to collect any possessions) and then off the premises by (and I quote) "a rather burly security guard".

When I asked senior management why my boss was fired, I was told it would be best if I said nothing, so I did say nothing.

I heard, a couple of years later that he'd been ordering iPads, reporting them stolen to the supplier, so they'd send out a replacement that he could sell to his friends, and we had the original..

[KurzweilGeist]

They had more access than the average Joe

Maybe they were schizophrenic and the other one did the damage.

[JPCavendish]

When I left my (Fortune 500, blue chip) employer a few years back, I was given a date on which access would be revoked; and sure enough it was - they were very consistent and very thorough when it came to the final day of employment.

But the date was 2 months in the future, and I had effectively free rein until then to do whatever I wanted. Not much security.

On the other hand, one of my team was let go for gross misconduct (working from abroad without telling the company) - his access to everything was withdrawn 10 minutes before HR and I had the call with him. In fact I got a message from him right before the call asking if I knew anything about why his access to some obscure sales database no longer seemed to work.

The company used hierarchical access management, so at any given time pulling the "no longer works here" plug meant that everything under that ceased to work.

[Anonymous Coward]

As a youngling maths student I interned at a "doesn't officially exist" Secret Govt Dept (but who live in a rather nice donut building that featured in all the architecture magazines)

Our head of dept was retiring and HR had a list of everything ever issued to him that had to be returned before departure.

Every mechanical pencil, every ashtray, every desk blotter, back to his days at Bletchley Park (or possibly the Crimean War) had been carefully recorded and had to accounted for

He may still be there today, perhaps as a "Residual Human Resource" on Mahogany Row

[Rattus]

Although I am impressed with the countermeasures in place to "disable" unauthorised users of the Memex terminals

[Anonymous Coward]

I was made redundant many years ago from a small-ish telecoms provider ( eventually acquired by a larger competitor ) and I had, at the time, access to all their routing infrastructure and a SecurID fob for the MFA.

I asked, then posted the fob back to a friendly IT sysadmin I knew, who acknowledged receipt - no way I was going to have anyone be able to point the finger at me if anything went wrong in my notice period.

[steviebuk]

Happened at

the NHS back in 2010 when I left. My NHS e-mails were still coming into my personal iTouch, 3 months after I left. I was curious to see how long before anyone noticed and locked my account. Eventually told an engineer still working there. She said "I told them the day you'd left to lock your account, clearly they didn't".

[MachDiamond]

Re: Happened at

She said "I told them the day you'd left to lock your account, clearly they didn't".

The "told them" part is a concern. It would be better if they were "notified" and a confirmation was required when it was done.

[Yet Another Anonymous coward]

Re: Happened at

It's the NHS, the message would have had to be hand written by a Doctor and then faxed

[steviebuk]

Re: Happened at

Funny that as I had to fax my timesheet to the agency from there all the time.

[Excused Boots]

Re: Happened at

It was, but nobody could read the handwriting.

[steviebuk]

Re: Happened at

She did. She did everything by the book and took her own records in case they tried to fuck her over (thats what management were like there).

[BonezOz]

Still Have Access

I left a company 7 or 8 years ago, and I think that I still have access to their GIT, though I haven't tried in a very long time. I also remember their default root password that they put on all the media servers they sold to clients, and I can practically guarantee that hasn't been changed, since I was the only one that knew how to change it in the default build image.

Will I ever use this information for nefarious reasons? No, the company and I split on good terms, it was my direct manager that got rid of me, cancelled my contract, that I would have sought revenge on, but he too got fired, for bullying.

[Yet Another Anonymous coward]

Re: Still Have Access

>I also remember their default root password that they put on all the media servers

It's "Swordfish", the password is always "Swordfish"

[JMcKeand]

Re: Still Have Access

No, it must be in hex: DE-AD-BE-EF

[MachDiamond]

Re: Still Have Access

"It's "Swordfish", the password is always "Swordfish""

Never ask an Igor to tell you what the password is unless you have a towel handy.

[Claptrap314]

Demand confirmation

If you've got the chops to swim with the commentards here, you almost certainly have the ability, should you be motivated, to cause various levels of trouble for your employer should your access not be properly terminated.

At my last, ahem, departure, I "requested" an email from the CTO stating that my access to all systems had been removed. While their security was not horrible, it was not great, either, and I REALLY don't want the cops bothering me 3-6 months down the road...

[Archivist]

When I left...

For my own security I insisted on watching me being deleted from the domain controller users.

[Anonymous Coward]

Re: When I left...

before AD Recycle Bin existed I guess

[Anonymous Coward]

Inspired me to check...

...if the root credentials for the remote access gateway that I have from a previous employer I left over a decade ago are still good.

They were.

I'm not sure if I should tell them or just not get involved in case I get accused of "hacking" or something by whatever idiot is running the place now that hasn't changed the internet facing password of a remote access box in FOURTEEN YEARS.

(Posted as AC just in case they somehow know who I am)

[chriswoods]

This is why Identity Management systems exist

[Antron Argaiv]

When I retired, I posted back my laptop, access badge and MFA device. Kept the delivery confirmation.

My final pay stub included an amount for unused time off. Before I left I had take the precaution of screenshotting the PTO balance as displayd by their system (I don't know why, just had a feeling).

Sure enough, when I did the math on the amount they paid...it was short. By a LOT. I sent an email to the HR person and included a copy of the pay stub, my screenshot, and my calculation. I got a very quick reply from someone higher up in HR and the missing amount was direct deposited in my account within a few days. In this state, the unused PTO balance must, by law, be included in the final paycheck. I knew this, and they did as well. I have no explanation for why it was only partially paid, and they provided none.

Trust, but verify.

[dr john]

Not quite as bad, but useful for me to take advantage of

Many years ago my original existing webhost was sold to a bigger company, who used a setup that I found harder to use. After a couple of years, I decided to move to a different host, and closed my account with them.

A year or two later I received an annual newsletter from them and I wondered if they had closed it totally, so I tried to log in and it still worked. And there were all my files from that time, although some were now out of date and new files, of course, were not there. So I tried to upload a couple of the newer files and it worked! I had a backup at home as well, but two backups are better than one, so I uploaded all files for all the websites I had. I did this every six months or so, for SIX or SEVEN years!

Then, much later on, while making my usual local backup there was a computer crash that managed to corrupt all my original web files AND the backup copies on the external drive, as it worked through many folders of files doing something very wrong Luckily it only affected the websites it was supposed to be transferring, and not the rest of the stuff on the hard disk...

I logged in to the old, supposedly closed, account, and it still worked, and so recovered everything easily - their system would let me download all the folders within the root one with just a few clicks, while on the new host I would have to work manually on each and every folder, and have created them again on my computer before the download. And you can easily miss something that way. Only a few files were out of date as I had had little work for a couple of months at that point in time, but I could get these few files from the current host.

And about year or two later I got an email from this old host who I hadn't paid a penny to for close to a decade to say they were going to close the account totally and I had two days to download anything I needed. They also casually mentioned that there was some recent activity on the account, and hoped it wasn't a hacker at work. I'm sure they knew it was me. Three days after their email, the account and login were not usable.

This old webhost had been sold to the bigger company but kept its name, and I think it was transferred as active just before the old owner marked it as closed.

So I am wondering. does this make me a bad person? Or just very lucky?

[pbryant]

I'm a CISSP and California licensed investigator. One of my favorite cases involved a Silicon Valley company that decided to do a layoff-notice-by-fire-drill. They triggered the fire alarms, and when the employees had gathered at their evacuation zone, they announced that only certain people could return to their desks inside. The rest were laid off. When the terminated staff returned home, they found their VPN sessions still active. It was pure mayhem and the company never did fully recover. That was 15 years ago. The Suits never learn.

[Anonymous Coward]

A bit like academia.

When I retired from an 'associate academic' role I had 30 days of e-mail access to deal with anything in my e-mail account, forwarding stuff to my outside accounts etc, but no access to my other drive storage, full academics however retained full access to both e-mail and other stored data, unless they offend H.R. or the lefty looneys in admin when they retired. Even if they start doing 'consultant' work for another University they usually retained full access, how much 'leakage' of data and commercial/military valuable 'intellectual property' occurs is NEVER discussed...