5 ms·
And disused account, which probably means an employee who left.
by kevin_b_er 5y ago
And disused account, which probably means an employee who left.
- gabereiser 5y agoThis. Have a solid offboarding checklist that includes VPN credentials or any access to systems that employee might have. At this point I don’t have any sympathy for the hacked when it’s as simple as this.
- agsamek 5y agoThe offboarding checklist is not enough. You should have regular cleanup procedures which synchronize accesses with the main source of truth as well. There are too many exceptions and just human errors for a time constrained checklist execution to be enough. Checklist is a 90% solution which might help here. Or it might have been the case where the checklist failed.
- rorykoehler 5y agoIt’s nearly always as simple as this. I got flamed on here for suggesting that Twitter just needs to follow NIST or similar standards to avoid the hack they had last year instead of hitting expert security researchers.
- ed25519FUUU 5y agoInvalidating credentials should be a one-stop-shop action. There shouldn’t be “invalidate their email, invalidate their VPN, invalidate their corporate login...”
- gabereiser 5y agoExactly. If everything is based on SAML SSO this is easy. If you manage multiple user databases for access control it’s a bit harder.
- mac-chaffee 5y agoThis is a requirement for ISO 27002. Just had to implement an offboarding checklist recently.
- beermonster 5y agoCan you explain this? I thought ISO 27002 was implementation guidance for ISO 27001. No mandatory requirements even the Annex A controls themselves aren’t mandatory.
- mac-chaffee 5y agoGood point. At the company where I work, we have an ISO compliance team that converts that guidance into mandatory requirements. So the authority is coming from company policies rather than ISO itself.
- gabereiser 5y agoCorrect. Most companies won’t interpret and just mandate the guidance recommendations.