Ttyjukl

A colleague of mine had some very privileged access to sensitive information, that was kept in remote machines with no internet access whose files could not be copied to local machines.

He quit the company for a new job, and there was bit of trouble in the transition when he left.

One point that seemed obvious to me, but other people in the company seem not to agree was:

I believe the severing of his accesses should not have been discussed with him

Part of this, was because some of his accesses were made through methods that were not agreed upon (pretty sure he was never authorized to do so). And it may not be clear to everyone that this happened. The area's director was informed and took no action in the past, he claimed now not to have understood the situation before.

But also, I feel like talking to a person on how you cut his privileges is somewhat lack of professionalism, like telling to his face "I don't trust you, so I'm concerned you might want to do something bad". Or otherwise you may be giving a final chance for the person to collect some collateral: "Hey, just letting you know that tomorrow you won't be able to access that classified info, so steal it now if you forgot to do so before!".

Are there known practices or guidelines for this situation? Is the correct approach to discuss with the person or not?

This breaks down to several things.

Yes, discussing something with an employee on the way out is risky, but so is shutting him down without a word.

There are several things that factor in:

• Reason for separation


• Difficulty of transition


• Level of trust

Reason for separation

Is this a voluntary separation, or an involuntary one?

If the person is leaving on good terms, then there's every reason to discuss the transition period, including when access will be shut off? Even if it's involuntary, there's quite a difference between someone leaving due to layoffs and someone being fired. Someone being laid off and not fired for cause may need to transition someone, and if severance is involved, they have quite the incentive to leave on a high note.

The risk in not discussing these things with someone leaving voluntarily or due to a layoff is that you would be showing them disrespect, which then opens you up to sabotage through malicious compliance, and having made an enemy unnecessarily. If you don't trust a person with access to the systems, then send them home with pay for the remainder of their notice period.

If the person is being fired for cause, you want to shut things down the moment he's notified.

Difficulty of transition

A person could be involved in projects where access to critical systems is required for them to wind down/teach a replacement to ramp up to taking over. If this is the case, then you certainly want to discuss termination of access with him. If Joe gave his notice, you'll want to discuss how long it will take for him to transfer his duties to Bob, and how much time it will take. This also goes hand in hand with the "Hit by a bus theory". A friend of mine was let go, they terminated his access, and there was literally no one to handle his work. Oooops. Yes, the people who were responsible were themselves terminated.

Level of trust

This is the big one, and remember, trust is a two way street. If you trust Bob, and Bob has good intentions, why wouldn't you discuss it with him. Personally, I wouldn't want access a day longer than I needed it, because I wouldn't want to be associated with any difficulties, or want to fix it.

The degree of discussions should be directly proportionate to trust.

If you don't trust him, why even have him in the building? If you do, why make him think he's not trusted? Who knows, you may want to hire Bob back if things change, or you may need to consult him on something in the future. A former employee who was shown trust on the way out might be amenable to taking a few phone calls if questions arise after his departure, one who was shut down without any notice might think, "Well, the heck with them then!"

This is a common problem with a common solution. When an employee leaves

1) On their last day, their SSO account is disabled.

2) If the company has non-internet connected "secret rooms" then the security chief goes around to each "secret room" and ensures access is removed

3) The security chief should review access to "secret rooms" once a month.

If the employee is trustworthy and has given notice, then it is very appropriate to work on a transition plan together, including setting up new accesses for replacements and shutting down access for the employee who is leaving. This can be a valuable part of the hand-off, making sure that the replacement truly does have adequate access. When the employee is leaving for a new job, unless there were issues with them, this is common.

The problem comes when the employee is being fired or is leaving under bad circumstances. The access still needs to be removed, but it is also important to make sure that all the access points are known, both for removal and for the replacement to have. A discussion is usually not the best way. If the business has overlooked that part of their security, and have that single point of failure, then a discussion or hiring someone to help them find the access points are often the only options.

In the US, often those who are laid-off were trusted and professional employees who would be glad to do a standard hand off of access information, but the current standards is that they are treated the same as firings: remove access without their knowledge, as they are being told of their redundancy.

That is why setting up documentation before hand is always better. It is always better to already know what servers there are and how to connect to them, just in case a key player leaves, for whatever reason.