Quitting employee has privileged access to critical information

Question

A colleague of mine had some very privileged access to sensitive information, that was kept in remote machines with no internet access whose files could not be copied to local machines.

He quit the company for a new job, and there was some trouble in the transition when he left.

One point that seemed obvious to me, but other people in the company seem not to agree was:

I believe the severing of his accesses should not have been discussed with him.

Part of this was because some of his accesses were made through methods that were not agreed upon (pretty sure he was never authorized deploy them). And it may not have been clear to everyone that this happened. The area's director was informed and took no action in the past, he claimed now not to have understood the situation before.

But also, I feel like talking to a person on how you cut his privileges is somewhat lack of professionalism, like telling to his face "I don't trust you, so I'm concerned you might want to do something bad". Or otherwise you may be giving a final chance for the person to collect some collateral: "Hey, just letting you know that tomorrow you won't be able to access that classified info, so steal it now if you forgot to do so before!".

Are there known practices or guidelines for this situation? Is the correct approach to discuss with the person or not?

EDIT:

I've mentioned that he had unauthorized accesses to a shared machine with sensitive info, which was supposed to be accessible only from computers at the company's VPN. I'm not so sure myself how this came to be, but while one authorized connection to the machine was being severed (and the leaving person was the one who set it up), it was found out that there were at least three unauthorized firewall exceptions. It was also seen at some point that he could remotely access the machine from anywhere and copy sensitive files, which should be impossible even for machines in the company. Hence there was at least this malpractice in his record, even if it does not (necessarily) cause a breach of trust. Also, we do have IT people who are generally responsible for this sort of stuff and have their procedures, but this employee was not with the IT team.

Answer 1

This breaks down to several things.

Yes, discussing something with an employee on the way out is risky, but so is shutting him down without a word.

There are several things that factor in:

• Reason for separation
• Difficulty of transition
• Level of trust

Reason for separation

Is this a voluntary separation, or an involuntary one?

If the person is leaving on good terms, then there's every reason to discuss the transition period, including when access will be shut off? Even if it's involuntary, there's quite a difference between someone leaving due to layoffs and someone being fired. Someone being laid off and not fired for cause may need to transition someone, and if severance is involved, they have quite the incentive to leave on a high note.

The risk in not discussing these things with someone leaving voluntarily or due to a layoff is that you would be showing them disrespect, which then opens you up to sabotage through malicious compliance, and having made an enemy unnecessarily. If you don't trust a person with access to the systems, then send them home with pay for the remainder of their notice period.

If the person is being fired for cause, you want to shut things down the moment he's notified.

Difficulty of transition

A person could be involved in projects where access to critical systems is required for them to wind down/teach a replacement to ramp up to taking over. If this is the case, then you certainly want to discuss termination of access with him. If Joe gave his notice, you'll want to discuss how long it will take for him to transfer his duties to Bob, and how much time it will take. This also goes hand in hand with the "Hit by a bus theory". A friend of mine was let go, they terminated his access, and there was literally no one to handle his work. Oooops. Yes, the people who were responsible were themselves terminated.

Level of trust

This is the big one, and remember, trust is a two way street. If you trust Bob, and Bob has good intentions, why wouldn't you discuss it with him. Personally, I wouldn't want access a day longer than I needed it, because I wouldn't want to be associated with any difficulties, or want to fix it.

The degree of discussions should be directly proportionate to trust.

If you don't trust him, why even have him in the building? If you do, why make him think he's not trusted? Who knows, you may want to hire Bob back if things change, or you may need to consult him on something in the future. A former employee who was shown trust on the way out might be amenable to taking a few phone calls if questions arise after his departure, one who was shut down without any notice might think, "Well, the heck with them then!"

Answer 2

This is a common problem with a common solution. When an employee leaves

1. On their last day, their SSO account is disabled.

2. If the company has any higher security areas not tied to SSO, then the security chief needs to review access and remove the now ex-employee.

3. The security chief should review access to the above areas at least once a month.

If the parting might become heated (i.e. firing), then also

1) Call the person into an office, and tell them to leave their computer. In general, there should be 2 employees in this meeting along with the soon to be fired person. If possible, escort this person to a non-secure area.

2) One of the employees should email, call, or text as soon as the person is away from their computer. You can also begin the firing.

3) Follow the steps above.

4) Do not leave the person unattended until all the step above are complete. If they need a bathroom break, escort them to the bathroom door and wait outside for them.

5) Once you receive the all clear from the security chief + SSO has been disabled, they are allowed to return to their desk, with an escort, and pack personal belongings.

EDIT:

Several commenters have mentioned this seems extreme, which I don't understand at all.

The first 3 steps (hopefully) what every company does when someone moves on. Ex-employees shouldn't have access to their old work-place once they leave. That's a danger to bo the employer, and the employee. (What happens if there is a theft)

The "firing" steps are pretty normal too. Even if it's a layoff, people will get emotional, and some of them may lash out (like live-tweeting the event).

Hopefully, it will only take a few minutes to turn off SSO, and revoke access. It should not be a 30-minute ordeal.

Answer 3

Telling an employee who's on the way out that you'll be terminating their access to company resources should not be considered any kind of insult. It's standard procedure that only employees with a need for access should have them, and he would be more surprised if his access to critical information were maintained after he leaves. It has nothing to do with trust -- he no longer has a need to access that information, so he shouldn't have the ability.

If he currently has the primary responsibility for the data, his input may be helpful in implementing the transition. If he's leaving on good terms, he'd probably want to be involved in this.

Answer 4

If the employee is trustworthy and has given notice, then it is very appropriate to work on a transition plan together, including setting up new accesses for replacements and shutting down access for the employee who is leaving. This can be a valuable part of the hand-off, making sure that the replacement truly does have adequate access. When the employee is leaving for a new job, unless there were issues with them, this is common.

The problem comes when the employee is being fired or is leaving under bad circumstances. The access still needs to be removed, but it is also important to make sure that all the access points are known, both for removal and for the replacement to have. A discussion is usually not the best way. If the business has overlooked that part of their security, and have that single point of failure, then a discussion or hiring someone to help them find the access points are often the only options.

In the US, often those who are laid-off were trusted and professional employees who would be glad to do a standard hand off of access information, but the current standards is that they are treated the same as firings: remove access without their knowledge, as they are being told of their redundancy.

That is why setting up documentation before hand is always better. It is always better to already know what servers there are and how to connect to them, just in case a key player leaves, for whatever reason.

Answer 5

There are lots of good answers here already, but what I have not seen mentioned is application of trust but verify. You do need to have certain degree of trust in your employees, particularly employees with very privileged access (e.g: An IT employee with domain admin privileges). However, you also need to verify that a particular employee is behaving in an appropriate, secure manner.

As to how to verify, upon the termination of an employee, it is best practice to continuously monitor the account of that terminated employee for any activity and such activity discovered should be promptly investigated to determine if malicious activity is taking place. Why unlikely to occur, there is still a risk, albeit how slight, that the terminated employee used company computing resources for unauthorized purposes, such as installing a backdoor to retain remote access.

At my employer, I worked with management to implement additional detection mechanisms, and improve the ones the Information Security team is already using, mechanisms such as DLP software, IDS / IPS, and SIEM. Any activity on the accounts of terminated employees triggers an SIEM alert to our team, and such alert is to be treated as a critical priority, to be either remediated or escalated within a certain SLA. Having such procedures means the importance of trust can be somewhat lessened.

The other answer also mention the need to communicate transitioning procedures to whoever will be taking over the role. Assuming the employee is leaving voluntarily, I agree the transition discussion should be held with the departing employee, but not necessarily to discuss the specific termination procedures, unless departing employee had a need to know such information when employed. Access administration procedures are usually sensitive, and distribution of that information should be based on least privilege. Only individuals with a job need to know such procedures, such as IT Security or HR, should be privy to it. As remote as it may be, excessive details provided to the terminated employee, could possibly be exploited for company harm.

Answer 6

On the contrary

It is in his best interest to have a complete handover, including explicit acknowledgement of access rights revoked. This is in no way insulting or a sign of distrust or anything. It's an administrative step and may well be explicitly required by company policies and/or compliance regulations.

Picture this: Three weeks after your friend left, something happens with that sensitive information. Thanks to the explicit handover he received, he is clear. It cannot possibly have been him. No accusations, no assumptions, no investigation.

I have in the past left positions where I had access to highly sensitive information. The company did not have such a procedure. So I stood behind my successor and made him change all passwords on all my accounts.

Answer 7

Are there known practices or guidelines for this situation?

Yes - it's called "Garden leave"; named that way because the company pays the person to sit in their garden.

The employee remains on the pay roll for the remainder of their notice period, but is not allowed to start a new roll until that period has expired. This hides the lack of trust of an employee with what seems a gracious offer of giving them a modest amount of holiday.

If the employee is unable to do anything productive anyway, then there's no point in having them in the office.