5 ms·

There is a symbiotic relationship between HR and IT. In my orgs, when HR TELLS US, in advance, we nuke the creds while they are discussing the term with HR. If

There is a symbiotic relationship between HR and IT. In my orgs, when HR TELLS US, in advance, we nuke the creds while they are discussing the term with HR. If HR doesn't tell us, then we have zero way of knowing to kill their account. When they don't tell us, then termed users continue to have access... again... because we have no way of knowing to term the access.

Volundr 3y ago
Don't underestimate a dumb managers influence on this. Back when I was running an orgs IT we had a similar incident when we fired an employee. HR had given us the heads up when it would happen, and we had someone standing by to kill their credentials (as the meeting started someone would give the final go ahead). Their manager however decided to "get it over with" without telling us, then when said employee asked if they could get some information off their work computer, proceeded to sit with them while they attempted to delete all their work. I was able to recover it from OneDrives second recycle bin so nothing was lost, but I was livid. This employee was literally being fired because they were refusing to train anyone else on their work for "job security purposes", it's not like we didn't have warning this wouldn't be graceful.
- sonicanatidae 3y ago
  I remove this from HR's and other Department's hands, once IT is made aware. Beforehand, I obviously cannot affect. They tell IT in advance and maintain the schedule and contact us to adjust or DRAMA. Lots and lots of drama. Had I been in that situation, I would taken that garbage to my direct Super, which is usually the CFO. I would explain why this is such a horrific idea. They usually agree. If they don't, then I look for somewhere else to work, since I cannot keep PHI secure, when I cannot control who has what access and when. I'm not going to be held responsible when others callous actions remove all the guardrails. No thanks.
  - Volundr 3y ago
    In short, the issue is that the manager didn't keep to the schedule. If they had done it at the proper time HR would have been involved and we would have gotten our notification. Instead the damage was done hours before this was scheduled to happen. In terms of higher-ups notification the "oh shit can you recover this" call came from the CEO I don't know what happened to the manager. I can't imagine it ended well for them, pretty much that entire section of the org was on thin ice (acquisition that didn't want to absorb into the company) so I can't imagine it ended well. I know we didn't pursue legal action against the ex-employee, which pissed me off at the time, but I can see the logic in leaving it done and dusted. The only PHI the company held was what HR had on it's the employees, so not at risk here.
    - sonicanatidae 3y ago
      It's often not pursued by a company unless there are literal damages. Morality, sadly, has nothing do to with the decisions corporations make. I'm glad to know you didn't suffer for this. It happens so much in the tech world that most of us have installed creature comforts in the space under the bus. I've installed a nice recliner, a small, but tasteful lamp and a few good books to read, during my time under it.
FirmwareBurner 3y ago
Naturally, that sounds on point for every company everywhere. Though I've heard it's quite common in large enterprises that are fragmented due to a lot of aqui-hires, for corporate HR to forget or miss people they supposed to fire and who still remain on the payroll, especially on the satelite offices where there's no on-prem HR and nobody really knows what's going on from central. A friend of mine was theoretically fired along with his entire team but just not him because corporate HR forgot about him or something, so he still showed up at the office without his team and without any work to do, badged in and played videogames all day for almost a year while getting paid in full, until some other people started asking "hey, who's is this guy and what does he actually do here all by himself?", then they actually fired him, or more like paid him a generous severance package to leave voluntarily in silence and not tell anyone about HR's blunder. Lucky bastard.
- sonicanatidae 3y ago
  This happens, but Last Access Audits usually catch them. Most people don't continue working after they've been termed. Not a silver bullet, but it covers a majority of these cases.
- 0cf8612b2e1e 3y ago
  Was it required he even show up to work? Presumably the checks would keep coming. On the other hand, in a just world, continuing to show up would make it impossible for the company to try and claw back the money. He was available even if nobody asked anything of him. I am more interested in how he was caught. There are many people around me who seemingly do nothing, he would just blend into the crowd. Were there layoffs or some other accounting of personnel that forced the issue?
  - sonicanatidae 3y ago
    It's usually time. I knew a guy that "worked" at Walmart. His job was collecting the carts. He would clock in, then go on about his day. When it was time to clock out, he would drive back and clock out. It took 8 months for the store to realize this and fire his butt. In his case, it was a meeting. It was an All Hands, his timecard showed he was clocked in, but never appeared at the meeting.
r00fus 3y ago
Modern IT integrations connect the HR system to the IT to auto-provision (ie, hire) and auto-deprovision (ie, terminate) user access in near-real-time. In this case, once the termination is completed (& approved) in the HR system, the user loses access immediately without any IT involvement. Here's an example of how Microsoft supports auto-provisioning from SAP Successfactors for this: https://learn.microsoft.com/en-us/entra/identity/saas-apps/sap-successfactors-inbound-provisioning-tutorial https://learn.microsoft.com/en-us/entra/identity/saas-apps/s...
- tharkun__ 3y ago
  Which works if every single tool you use is hooked up to your one central authentication provider. Then there are tools that aren't. Entire acquired company's systems that aren't (yet). Parts of those companies nobody know exist and thus aren't ever migrated over etc.
- sonicanatidae 3y ago
  This all assumes the one thing IT cannot have, under any circumstances. The budget to pay for it.
jcpham2 3y ago
Yeah I have the same (symbiotic) lack of symbiosis relationship with HR so I run scripts and other automated tasks every so often to verify all the employees are actually using the accounts. Sometimes new people get hired and have to wait because HR cannot follow the simple instructions I ask for. Like a person's name typed out and emailed to me.
- sonicanatidae 3y ago
  Historically, I went to the mat arguing that I won't let my departments even create new accounts unless the "new account" form is used. This is PHI, we get 1 chance to get it right. There has been pushback, but I'm always willing to walk away from jobs that insist on stupid.

Volundr 3y ago

Don't underestimate a dumb managers influence on this. Back when I was running an orgs IT we had a similar incident when we fired an employee. HR had given us the heads up when it would happen, and we had someone standing by to kill their credentials (as the meeting started someone would give the final go ahead). Their manager however decided to "get it over with" without telling us, then when said employee asked if they could get some information off their work computer, proceeded to sit with them while they attempted to delete all their work. I was able to recover it from OneDrives second recycle bin so nothing was lost, but I was livid. This employee was literally being fired because they were refusing to train anyone else on their work for "job security purposes", it's not like we didn't have warning this wouldn't be graceful.

sonicanatidae 3y ago
I remove this from HR's and other Department's hands, once IT is made aware. Beforehand, I obviously cannot affect. They tell IT in advance and maintain the schedule and contact us to adjust or DRAMA. Lots and lots of drama. Had I been in that situation, I would taken that garbage to my direct Super, which is usually the CFO. I would explain why this is such a horrific idea. They usually agree. If they don't, then I look for somewhere else to work, since I cannot keep PHI secure, when I cannot control who has what access and when. I'm not going to be held responsible when others callous actions remove all the guardrails. No thanks.
- Volundr 3y ago
  In short, the issue is that the manager didn't keep to the schedule. If they had done it at the proper time HR would have been involved and we would have gotten our notification. Instead the damage was done hours before this was scheduled to happen. In terms of higher-ups notification the "oh shit can you recover this" call came from the CEO I don't know what happened to the manager. I can't imagine it ended well for them, pretty much that entire section of the org was on thin ice (acquisition that didn't want to absorb into the company) so I can't imagine it ended well. I know we didn't pursue legal action against the ex-employee, which pissed me off at the time, but I can see the logic in leaving it done and dusted. The only PHI the company held was what HR had on it's the employees, so not at risk here.
  - sonicanatidae 3y ago
    It's often not pursued by a company unless there are literal damages. Morality, sadly, has nothing do to with the decisions corporations make. I'm glad to know you didn't suffer for this. It happens so much in the tech world that most of us have installed creature comforts in the space under the bus. I've installed a nice recliner, a small, but tasteful lamp and a few good books to read, during my time under it.

FirmwareBurner 3y ago

Naturally, that sounds on point for every company everywhere. Though I've heard it's quite common in large enterprises that are fragmented due to a lot of aqui-hires, for corporate HR to forget or miss people they supposed to fire and who still remain on the payroll, especially on the satelite offices where there's no on-prem HR and nobody really knows what's going on from central. A friend of mine was theoretically fired along with his entire team but just not him because corporate HR forgot about him or something, so he still showed up at the office without his team and without any work to do, badged in and played videogames all day for almost a year while getting paid in full, until some other people started asking "hey, who's is this guy and what does he actually do here all by himself?", then they actually fired him, or more like paid him a generous severance package to leave voluntarily in silence and not tell anyone about HR's blunder. Lucky bastard.

sonicanatidae 3y ago
This happens, but Last Access Audits usually catch them. Most people don't continue working after they've been termed. Not a silver bullet, but it covers a majority of these cases.
0cf8612b2e1e 3y ago
Was it required he even show up to work? Presumably the checks would keep coming. On the other hand, in a just world, continuing to show up would make it impossible for the company to try and claw back the money. He was available even if nobody asked anything of him. I am more interested in how he was caught. There are many people around me who seemingly do nothing, he would just blend into the crowd. Were there layoffs or some other accounting of personnel that forced the issue?
- sonicanatidae 3y ago
  It's usually time. I knew a guy that "worked" at Walmart. His job was collecting the carts. He would clock in, then go on about his day. When it was time to clock out, he would drive back and clock out. It took 8 months for the store to realize this and fire his butt. In his case, it was a meeting. It was an All Hands, his timecard showed he was clocked in, but never appeared at the meeting.

r00fus 3y ago

Modern IT integrations connect the HR system to the IT to auto-provision (ie, hire) and auto-deprovision (ie, terminate) user access in near-real-time. In this case, once the termination is completed (& approved) in the HR system, the user loses access immediately without any IT involvement. Here's an example of how Microsoft supports auto-provisioning from SAP Successfactors for this: https://learn.microsoft.com/en-us/entra/identity/saas-apps/sap-successfactors-inbound-provisioning-tutorial https://learn.microsoft.com/en-us/entra/identity/saas-apps/s...

tharkun__ 3y ago
Which works if every single tool you use is hooked up to your one central authentication provider. Then there are tools that aren't. Entire acquired company's systems that aren't (yet). Parts of those companies nobody know exist and thus aren't ever migrated over etc.
sonicanatidae 3y ago
This all assumes the one thing IT cannot have, under any circumstances. The budget to pay for it.

jcpham2 3y ago

Yeah I have the same (symbiotic) lack of symbiosis relationship with HR so I run scripts and other automated tasks every so often to verify all the employees are actually using the accounts. Sometimes new people get hired and have to wait because HR cannot follow the simple instructions I ask for. Like a person's name typed out and emailed to me.

sonicanatidae 3y ago
Historically, I went to the mat arguing that I won't let my departments even create new accounts unless the "new account" form is used. This is PHI, we get 1 chance to get it right. There has been pushback, but I'm always willing to walk away from jobs that insist on stupid.