Revoking access privileges when someone leaves a job

Question

I work in a start up company, with a very small team. This has been my first and only job since I graduated too.

Recently, a person on design team left our company for greener pastures elsewhere and he had access to production server via ftp, emails etc. and I have rounded up all of the stuff that belonged to him and have discontinued / removed it from the server.

I was just wondering what the procedures are when someone leaves the company to remove all of their intra-company access? All this is fairly easy because we are a start up and I knew what exactly he was working as and what he had access to (as I was the one to set this all up) but we are also growing very quickly and there may come a time when I have to deal with a lot of people.

How do you keep track of who has access to what and what is the procedure to revoke access to all that? What happens to their emails? Google docs? How long should you wait before revoking their access? Should you do a general clean up of the system they used to work on? change the password for windows (actually, this guy was on a Mac, our dev team is on Windows, most others are on Macs).

Answer 1

As others have said, a checklist is critical. If you don't know what they had access to, there's no easy way to revoke it. Don't forget that people might also have access to external accounts on behalf of the company (like support contracts for Oracle or something like that, in addition to Google apps and such) and you'll want to be able to secure those as well.

What happens to their emails?

Old emails? Well, it depends on whether you think there is anything useful in there. While it is prudent to archive them, my experience has been that everything will be overcome by events and decisions that no one is likely to ever search those emails for information. Basically, whatever the archiving rules are for everyone should be followed for the exiting employee.

New emails sent to their account? If they were getting emails from outside related to the business it's smart to redirect any mail sent to their email address to someone else in the office. A small company for which I do some work had the office manager leave a few years ago and they still get some emails for her email address that the current office manager needs. A lot of website accounts get linked to email addresses and it would be shame if you couldn't do a password reset on one of those without having the account any more.

How long should you wait before revoking their access?

It depends on how they left. In some cases, I've had access and consulted back to former employers for years. If it's a hostile termination, revoking access before informing the employee may be prudent. In most cases, the person keeps working until their last day, so you follow the same security rules you have for everyone - they only gets rights to what they need to in order to do their job. Revoking access immediately might both piss off someone who thought they were leaving on friendly terms and inhibit them from transitioning their tasks to other team members or their replacement.

Should you do a general clean up of the system they used to work on?

Of course. There's a good chance that they might accidentally leave behind personal files or leave cookies with IDs and passwords behind on the computer. You don't want to expose the departing employee to identity theft or your company to any liability for making that possible.

Answer 2

How do you keep track of who has access to what and what is the procedure to revoke access to all that?

Come up with a process that all employees must follow ( no exceptions ) this could either be an email with certain information that you archive or a word document you print out and place in a folder for the employee at your desk.

My suggestion is that choose any format to get it to you but you should have both an electronic copy stored on perhaps an encrypted dand a paper copy at your desk.

What happens to their emails?

You archive them.

How long should you wait before revoking their access?

You should revoke their access before their last day. This means if you are getting rid of them, their access should already be revoked, personal files shouldn't be a problem since that is against company policy right?

Google docs?

You revoke their access to this account also.

Should you do a general clean up of the system they used to work on?

Just wipe the system.

change the password for windows (actually, this guy was on a mac, our dev team is on windows, most others are on macs)

I would assume his domain account is already inactive. If its not then deactive the network account, wipe the system, and assign the hardware to his replacement.

Answer 3

Generally, the process you describe is called "deprovisioning." It can be a headache for most HR departments because it is manual and frequently error-prone. One does not only need to disable accounts, but also notify insurance companies of the termination, or discontinue cell phone service.

I was just wondering what the procedures are when someone leaves the company to remove all of their intra-company access?

In most Windows environments, the account is locked in Active Directory. You never delete the accounts because they may come back, or you may need to set up the next guy with the same roles/permissions as the one who quit. Someone should have a list of what each person has been issued (such as SecureID tokens), and check them off upon departure.

Answer 4

As soon as somebody leaves company he should have revoked access to all sensitive data, resources, infrastructure, etc. His data should be stored, his workstation formatted, all the documents he was working on should be given to his manager no later than the day he leaves the company.

Big companies usually have a centralized system of granting and revoking privileges and a dedicated staff monitoring the privileges.