2

I was reading that for business's it is essential that they remove the user's account as soon as that person leaves the company. So, my question is why?

I understand the need to remove accounts which can accessed remotely, as the person who left the job could be disgruntled and leak the data to a competitor etc but I can't see the point of removing a user account on a computer immediately.

I know this question sounds really simple but I can't think of a specific reason why.

Any help would be greatly appreciated, thanks.

  • 1
    Haven't you just answered your own question? – pee2pee Feb 17 '17 at 13:13
  • Because any data leaked could doom your company ? Data is a critical asset in the era of information technologies. Sun Tzu talked about how intelligence is important thousands of years ago and it is more and more the case nowadays. – Answers_Seeker Feb 17 '17 at 13:43
  • What is a good reason to keep something you don't longer need? – Arminius Feb 17 '17 at 13:47
  • Misuse of an old account....you'd never find out who actually did it – Arlix Feb 17 '17 at 15:10
1

From my experience, there are 3 key concerns when an employee leaves an organisation:

  1. The risk of remoting in (As you said)
  2. Other employees (eg: admins) could abuse use the ex employees credentials knowing they would be difficult to track. Alternatively, disgruntled ex-employees could give their creds to an internal staff member and collude to leak out info.
  3. Data that the ex-employee leaves behind needs to be archived in case the organisation needs it (eg: important files/emails, etc). But this needs to be done securely as there could be personal/private employee info that is left behind which should not be accessible by other staff

These 3 reasons are the main reasons I find why employee accounts need to be deleted immediately on exit. It is also common practice for organisations to leave accounts around for while for "Housekeeping" purposes, but this practice again is very questionable.

Hope this helps

R

  • 2: An admin does have full access anyways. And admins does not need to know passwords, they can "RunAs" as someone else. I agree on the OPs comment that if physical & remote access restriction is maintained, theres no need for any control of computer accounts. Imagine a computer locked into a room with a access control reader. Theres no need for a password at all on that computer. As long as you terminate any ex-employees cards, it poses no security risk to leave lingering accounts on the secured computer. – sebastian nielsen Feb 20 '17 at 20:26
  • And tracing misuse of terminated accounts is pretty easy anyways, as they will leave lot of other traces in the system. Imagine scanning your badge to enter the office doors and then misusing a terminated account even if theres multiple office cubicles in the office. It will be instantly clear that you was done it, because each scanned badge could be correlated to a matching login, and the only mismatch found would be your badge. And computer IPs could be correlated and tracked too. – sebastian nielsen Feb 20 '17 at 20:29
1

Before I get to the meat of my answer down below, I think it's important to make a distinction that you should never ever under any circumstances delete a user account.

First and foremost, it's because deleting the account risks removing the historical audit log / record of that account's activity. You should immediately disable the user account and ensure it is unable to actively login or perform any activities anywhere on the network. This is true whether terminating an employee or after an employee voluntarily leaves, but you should never delete a user account, under any circumstances.

Doing so may actually be a violation of the law in certain jurisdictions if the employee was terminated, and even if not, at the very least, deleting the account and the associated historical record of that account's activity may put your firm at a distinct disadvantage if you ever have to defend your actions in a lawsuit.

Now to the more detailed answer....

I would say that it fundamentally boils down to "the principle of least privilege"

As US-CERT puts it:

Only the minimum necessary rights should be assigned to a subject that requests access to a resource and should be in effect for the shortest duration necessary (remember to relinquish privileges). Granting permissions to a user beyond the scope of the necessary rights of an action can allow that user to obtain or change information in unwanted ways. Therefore, careful delegation of access rights can limit attackers from damaging a system.

By definition of a user who is no longer employed with the company should have zero privileges since they have no legitimate function to do anything at the company with any resources.

Wikipedia provides a nice definition and an extensive breakdown of the benefits and advantages of adopting this fundamental first principle of information security:

In information security, computer science, and other fields, the principle of least privilege (also known as the principle of minimal privilege or the principle of least authority) requires that in a particular abstraction layer of a computing environment, every module (such as a process, a user, or a program, depending on the subject) must be able to access only the information and resources that are necessary for its legitimate purpose.

When applied to users, the terms least user access or -privileged user account (LUA) are also used, referring to the concept that all user accounts at all times should run with as few privileges as possible, and also launch applications with as few privileges as possible.

The principle of least privilege is widely recognized as an important design consideration in enhancing the protection of data and functionality from faults (fault tolerance) and malicious behavior (computer security).

Benefits of the principle include:

  • Better system stability. When code is limited in the scope of changes it can make to a system, it is easier to test its possible actions and interactions with other applications. In practice for example, applications running with restricted rights will not have access to perform operations that could crash a machine, or adversely affect other applications running on the same system.

  • Better system security. When code is limited in the system-wide actions it may perform, vulnerabilities in one application cannot be used to exploit the rest of the machine. For example, Microsoft states “Running in standard user mode gives customers increased protection against inadvertent system-level damage caused by "shatter attacks" and malware, such as root kits, spyware, and undetectable viruses”.

  • Ease of deployment. In general, the fewer privileges an application requires the easier it is to deploy within a larger environment. This usually results from the first two benefits, applications that install device drivers or require elevated security privileges typically have additional steps involved in their deployment. For example, on Windows a solution with no device drivers can be run directly with no installation, while device drivers must be installed separately using the Windows installer service in > order to grant the driver elevated privileges.

NIST goes further with specific process suggestions and justifications for each, though they largely echo the sentiments described earlier:

Least privilege refers to the security objective of granting users only those accesses they need to perform their official duties. Data entry clerks, for example, may not have any need to run analysis reports of their database.

...

Friendly Termination. Friendly terminations should be accomplished by implementing a standard set of procedures for outgoing or transferring employees. This normally includes:

  • removal of access privileges, computer accounts, authentication tokens,

  • the control of keys,

  • the briefing on the continuing responsibilities for confidentiality and privacy,

  • return of property, and

  • continued availability of data. In both the manual and the electronic worlds, this may involve documenting procedures or filing schemes, such as how documents are stored on the hard disk, and how are they backed up. Employees should be instructed whether or not to "clean up" their PC before leaving. If cryptography is used to protect data, the availability of cryptographic keys to management personnel must be ensured.

Unfriendly Termination. Given the potential for adverse consequences, organizations should do the following:

  • System access should be terminated as quickly as possible when an employee is leaving a position under less than friendly terms. If employees are to be fired, system access should be removed at the same time (or just before) the employees are notified of their dismissal.

  • When an employee notifies an organization of a resignation and it can be reasonably expected that it is on unfriendly terms, system access should be immediately terminated.

    • During the "notice of termination" period, it may be necessary to assign the individual to a restricted area and function. This may be particularly true for employees capable of changing programs or modifying the system or applications.
  • In some cases, physical removal from the offices may be necessary.

0

A general principle of cyber-security is that only authorized people have access to information/information systems or company assets. An "account" is attributes of a digital person and often includes a password hash which is a type of control (permitting or denying access).

Once a person leaves a company are they still authorized to access company information or information systems? If NOT why keep their account around needlessly?

There may be other reasons to employ different strategies. For example, many universities give students/staff email-for-life. In these cases there are reasons not to permanently revoke access so it may be permissible to keep accounts around. There may be other reasons to keep a copy of the digital person.

However, if such a reason doesn't exist, expunging an account is simply a good practice to revoke access.

  • 1
    If you're quoting a specific resource can you provide a link to it? – RoraΖ Feb 17 '17 at 15:59
  • 1
    You want a reference for the general principle ".. information is not to be made available or disclosed to unauthorized individuals"? Umm - Ok!? You realize that a reference is a jurisdictional thing right? If you live in Canada the reference should be Canadian etc. Start with en.wikipedia.org/wiki/Information_security#Key_concepts and check out the section titled "Confidentiality" and more specifically see how ISO 27001:2005 (as an information security standard). – user34445 Feb 17 '17 at 17:25
  • Since you used the quotation block it is generally assumed that you're quoting some sort of reference. – RoraΖ Feb 20 '17 at 12:05
0

I understand the need to remove accounts which can accessed remotely

I can think of 2 reasons why blocked remote access is insufficient:

  1. No technological measure can be proven to be bug-free / effective. If the mechanism preventing remote access fails the account is available for abuse

  2. The persisting account provides a means for the disgruntled employees still working in the organization to exploit the target system using someone else's credentials

Further considerations include:

  • licencing costs
  • someone with access to the backups has a larger set of accounts for which they can attempt to brute force a password match
  • compliance requirements - in the EU, "Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.