Hi Steve,
This is from something I put together some time ago -
Deny physical access:
-At termination, escort the individual while on premises and deny them
physical access to computers terminals systems.
- Remind all staff that under no circumstances are they to allow anyone
else to use their computer or (especially) their ID (I would not single
out this individual in the note).
-Recover company property such as keys, computers, access tokens,
manuals, data, software, credit cards, etc.
Deny Network Access
-Disable the all of the user's known accounts and passwords.
-Remove Special authorities and high-powered groups from the user
profile (if change control was sloppy, this could negatively impact
production).
-Depending on the perceived impact to production systems, work to
specifically exclude the User Profile from production libraries systems.
-Review dormant profiles and disable or change those profiles that can
be changed.
-Consider changing default passwords that the user may know (passwords
embedded in programs, etc. This may require programming changes).
-Depending on the risk profile, consider mandating that all users change
their passwords to eliminate the risk of "known" passwords.
-Review external connections such as wireless lans, VPN's dialup
connections, and vendor connections.
Monitor the user profile
-Turn on auditing for the user profile.
-Regularly review profile activity in the coming days and weeks.
-If you have automated monitoring software, send an alert anytime the
profile is used, or an attempt is made to sign on with the profile.
Remove agent rights
-Review the employee's status as an agent of the company.
-Notify vendors of the employee's separation. Ask them to revoke any
access to their systems
-If Employee has access to customer's accounts, notify and request
access be removed.
-Change passwords at vendor and customer accounts to prevent further
access by former employee.
HTH,
jte
--
John Earl, VP and Chief Technology Officer
PowerTech: 253-872-7788
Direct: 253-479-1408
Mobile: 206-669-3336
John.Earl@xxxxxxxxxxxxx
Email is an excellent way to communicate material that is not time
sensitive. If your communication is of a more urgent nature, please
call.
===========================
This email message and any attachments are intended only for the use of
the intended recipient named above and may contain information that is
privileged and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message or by telephone and delete the
message from your email system. Thank you.
-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-
bounces@xxxxxxxxxxxx] On Behalf Of Steve Martinson
Sent: Tuesday, July 03, 2007 9:30 AM
To: midrange forum
Subject: Preparing for a High-profile Termination
Situation:
High-profile, knowledgeable staff member soon to be terminated
(employment, not by Ahh-nold); has "keys to the kingdom" for both the
System i and the network; likely knows passwords for many service
and/or
utility profiles on the iSeries.
Requirement:
Prior to term date, analyze system for vulnerabilities associated with
a
position like the one described above and prepare a task list that
will
address the situation both before and after the termination.
Areas to be reviewed include system values, network attributes (exit
points too), directory entries, SST, job descriptions, subsystem
routing
entries, all user and group profile parameters and their implications,
authorities to libraries, directory (WRKLNK) authorities, etc.
Can anyone think of anything else that could be a critical hole that
should be reviewed/covered?
Best regards and TIA,
Steven W. Martinson, CISSP, CISM
Sheshunoff Management Services, LP.
Senior Consultant - Technology & Risk Management
2801 Via Fortuna, Suite 600 | Austin, TX 78746
Direct: 281.758.2429 | Mobile: 512.779.2630
e.Mail: smartinson@xxxxxxxxx
midrange.com
