Timeline for Should I disclose that I can still access a company's systems after I've left?
Current License: CC BY-SA 4.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 4, 2021 at 20:00 | comment | added | user3067860 | Let us continue this discussion in chat. | |
| Jan 4, 2021 at 19:56 | comment | added | rs.29 | @user3067860 As I said, it doesn't work that way. In any court, first question would be did you delete account of a former employee . If you didn't, that alone would show bad IT security practice . Then, you would need to provide other proof that exactly that person accessed your system - at least an IP address. Having just credentials of former employee is certainly not sufficient and could lead to serious counterclaim . | |
| Jan 4, 2021 at 19:31 | comment | added | user3067860 | @rs.29 You really think if someone logs in using the OP's credentials that anyone is going to say, "oh, it couldn't have been OP because we should have deleted that a long time ago"? And the OP doesn't just have to worry about (potential) criminal charges, if something happened there could easily be a law suit where the burden of proof is much different. (Disclaimer: I'm talking about the outlier situation where someone does access the system in a harmful manner, not the normal situation where nothing happens.) | |
| Jan 4, 2021 at 19:20 | comment | added | rs.29 | @user3067860 It doesn't go that way. In order to really accuse him (in court of law) they would need to have something more then his old credentials which they should deactivated a long ago. That something could be his IP and other "fingerprints" from his own devices. Bad thing for him would be if they discovered that somebody accessed their system using his device. | |
| Jan 4, 2021 at 19:15 | comment | added | user3067860 | @rs.29 It's like the office key, if each key had a person's signature and couldn't be copied. If someone accessed the office with your key you have a good defense (it wasn't me, I handed my key in on my last day and here is my receipt) and a bad defense (it wasn't me, I dropped my key down the toilet, I swear). No one wants to be in the latter situation, even if it isn't your responsibility to hand in the key. | |
| Jan 4, 2021 at 19:12 | comment | added | user3067860 | @rs.29 It is very much the OP's problem if the former company accuses them of accessing their system, showing that someone using the OP's credentials accessed the system. It would be much happier for the OP if they could easily refute that, "I couldn't possibly have used these credentials to access your system because you, yourself, made sure that I couldn't." | |
| Jan 4, 2021 at 19:07 | comment | added | rs.29 | @user3067860 Nope. That is not his problem, that is the problem of IT security of his former company. Frankly his account and his credentials are their property. They could do what ever they want with them. What matters for him is to remove any possibility that someone access company´s non-public servers from his own device, using his old credentials. | |
| Jan 4, 2021 at 19:02 | comment | added | user3067860 | It's not sufficient to just not access their systems. The OP also should have some way to show that it wasn't them in the case that someone else uses the OP's credentials. (Worst case, someone with administrative powers resets the OP's password and uses that to log in.) Unfortunately it's not possible to prove that you've deleted/forgotten/randomly scrambled every password on your own, which is why ideally account revocation would be done by someone at the company. | |
| Jan 4, 2021 at 18:56 | comment | added | rs.29 | @employee-X Well, no (e.g. involuntary manslaughter ). And in this case OP admitted he actually read financial data from his former company, something that is restricted to employees. As I said, it is the best for him to keep quit about it, stop doing it, and remove all data belonging to the company from his devices. Since he works in IT, he should know how. Otherwise, he could be dragged trough the courts, and even if not convicted it is an unpleasant experience. | |
| Jan 4, 2021 at 18:50 | comment | added | rs.29 | @ChrisStratton In theory I would agree with you, but unfortunately we live in a real real world :) In many cases, company would supply relatively cheap desktop, and due to COVID-19 expect work from home. You could haul machine back to your place or work remotely with your own device, with expectation that you still fulfill all security requirements. | |
| Jan 4, 2021 at 5:14 | comment | added | employee-X | Breaking the law (at least sometimes) requires intent to be demonstrated. If you try the code to someone else's home, that's a pretty good demonstration of intent to commit a crime. If you accidentally click a link, and are authenticated via an automated process, intent is harder to prove. IANAL, though. | |
| Jan 3, 2021 at 18:19 | comment | added | Chris Stratton | Such measures are unrealistic for 99% of people, and not something any employer would even think to ask for or expect their users to be capable of. A company that wants that needs to supply the device, full stop. Anything else is irresponsibly and absurdly putting the consequences of the employer's incompetence and cheapness on the employee, and cannot remotely be expected to work out in the employer's favor. | |
| Jan 3, 2021 at 18:18 | comment | added | rs.29 | @ChrisStratton Yes, I do understand. That is why I insist on separate work and private environment. If company doesn't issue their own device, either buy one for yourself, or create VM. At the very least, have separate folders for work. Learn how to delete individual cookies from the browser, how to remove tokens, or uninstall email client. It doesn't seem fair, but such is life. Rule of thumb, if you use company stuff on your own machine, it is your responsibility to remove it when you stop working for them . | |
| Jan 3, 2021 at 17:23 | comment | added | Anthony | @Chris Stratton , great point about the issue being in the form of unexpired session cookies. Applications that auto authenticate or those that rely on an active user session can indeed interact without user interaction. Depending on how cookie handling is done in the app, certain security exploits are possible, e.g: session riding | |
| Jan 2, 2021 at 22:19 | comment | added | Chris Stratton | @rs.29 - you're not understanding the issue of how poorly designed access mechanisms can lead to cached access tokens which still work after they no longer should. If those tokens are in the custody of an email client, a saved browser session, etc, those pieces of software can end up trying to use them without user intent or action. And regardless if they should, many companies do not issue devices for employees to use off-site, but expect instead that they use their own. | |
| Jan 2, 2021 at 19:42 | comment | added | rs.29 | @gnasher729 Very thin ice there. You are certainly allowed to use your company mail while you work for them. After that, not so much. Remember, your backups - your responsibility. IMHO, it is always a good practice to have completely separate private and professional computers, if at all possible. | |
| Jan 2, 2021 at 19:06 | comment | added | gnasher729 | “Broken the law” - nowadays, many people use their private computer for work. So my email is set up to access my private email, and my company email. I expect my company to close my company email account, and I will remove it from my mail app when I have the time. And then I have to figure out how to remove it from my backups. | |
| Jan 1, 2021 at 23:13 | history | answered | rs.29 | CC BY-SA 4.0 |