4 ms·

There's a reason why some companies are using measures that feel very inhuman when they fire someone: it's because of people like the one from TFA.

kstrauser 2y ago
I told my colleagues to do me a favor: if I'm ever let go for any reason, please terminate all my access immediately and diligently. It's for my protection just as much as theirs. If I can't get in, they can't blame me if something goes wrong down the road.
- candiddevmike 2y ago
  That is very threatening, why would you share this? If you truly think this way, you may want to consider a different career or look internally to figure out what makes you think this way. EDIT: I thought the "If I can't" portion read "If I can" in parent's comment. Disregard, sorry parent.
  - r2_pilot 2y ago
    Some people work in regulated environments with audit requirements.
  - ilikecakeandpie 2y ago
    Right? Just take the L and look for a new job
    - stetrain 2y ago
      I don't see how that's incompatible with wanting your access revoked on termination to avoid accusations of wrongdoing.
  - landryraccoon 2y ago
    Emotions aside, isn’t it just sensible security policy to delete all permissions and invalidate all credentials of a terminated employee as soon as possible? Any other approach would be exceptional.
    - snotrockets 2y ago
      Both sensible, and required by many compliance frameworks.
  - akira2501 2y ago
    > That is very threatening It's just creating "plausible deniability." > or look internally to figure out what makes you think this way. That's easy: Sarbanes-Oxley.
    - kstrauser 2y ago
      For me, HIPAA. I do not want access to a single resource or record that I don’t require to do my job.
  - cko 2y ago
    Just because someone wants plausible deniability doesn't mean they're considering doing something wrong. They could just not want to be even considered a candidate for blame. For example, if I was ever asked to babysit someone, I would want them to install a camera pointing at me at all times, for my sake and their peace of mind.
  - stetrain 2y ago
    What's threatening? I read that as just wanting their access removed as per policy/procedure, with no special treatment, because that both protects the employer from potential tampering and the employee from accusations of such tampering. I don't read any implied threat that they actually intend to or think they might do something harmful, just wanting a CYA in the same way the company wants one.
    - kstrauser 2y ago
      That's exactly it. I'm not asking them to save me from temptation or anything like that, or to provide me an alibi ("ok, you're locked out now wink"). I want them to do the right thing for our mutual benefit.
    - warunsl 2y ago
      Pretty sure they read "If I can't get in, they can't blame me if something goes wrong down the road." as "If I can get in, they can't blame me if something goes wrong down the road." That's the only interpretation that sounds threatening.
      - kstrauser 2y ago
        Ohhhhh, that makes much more sense now. If I read it that way, I'd also think I was a creep. Yep, they confirmed it.
  - kstrauser 2y ago
    It's called being a grownup. If I worked for a restaurant and was fired, I'd give them the keys immediately. If someone unlocked the door and stole stuff later, hey, look at someone else who still has the keys. I don't. It's the same here. If I'm fired from a tech job, the company should do the right thing to protect themselves and lock me out right then and there. It's not because I -- the real me, not the hypothetical villainous me -- pose a risk to them. I wouldn't hurt an ex employer under any circumstances because 1) that's a bad thing to do, and 2) I don't want to be in jail. It's more that best practice dictates they do this. There's no benefit to them whatsoever in allowing me into systems I no longer have a legitimate need to access. And again, this also protects me. If I'm long gone and something suspicious happens, talk to their current employees, not me. I don't want to access to their stuff, and I couldn't even if I wanted to. Edit: Ah, honest mistake. I could see why you'd think that given the misreading.
  - exe34 2y ago
    who's threatening whom?
  - gooseus 2y ago
    I was working at a medium sized accounting software firm over a decade ago when I was called into the CEOs office and sat down for an interrogation. Apparently they had setup their Exchange server poorly and I'd had access to any number of mailboxes (including the CEOs) and other folders that I wasn't supposed to have access to. I was completely unaware of this access, but was being directly accused of having access confidential information. I insisted, truly, that I wasn't aware of the access and hadn't looked at anything confidential, but they tried to tell me they had proof that I had accessed email I shouldn't have. At this I got upset and demanded they show me this proof, which they couldn't do because they didn't have any, but I'm guessing they thought I had seen some stuff and they could get me to cave it if they pretended they had proof. Anyways, I didn't get in any real trouble because I wasn't intimidated, but it damaged the relationship and I ended up quitting a few months later. Now I feel the same way as OP, I don't want to be in a position where someone can make a plausible accusation of misconduct, you could be totally honest and still end up railroaded just for being in the wrong place at the wrong time. CYA.
  - freehorse 2y ago
    If I work in a place where the data security practices are abysmal, where we have not been hacked and ransomed/extorted purely because nobody has bothered, I would definitely want to make sure that my access to any systems is revoked once I am no longer employed. I would not want to be anywhere close to a ticking bomb.
bitmasher9 2y ago
A more humane and complete way of handling this is to provide severance that is contingent on a smooth off boarding.
- deleted 2y ago
  [deleted]
ratg13 2y ago
He didn’t do anything malicious until half a year after his termination. This is a failure of the company. An inhumane offboarding would only encourage this.
jamesrr39 2y ago
Well, revoking credentials isn't inhumane. You can fire someone humanely and without compromising security.
- hot_gril 2y ago
  Was gonna say, they can bid you farewell without giving you access to stuff.
oneplane 2y ago
The reason of the measure you are describing is incompetence. But what happened here was a lack of: proper off-boarding, basic controls, and basic security hygiene. Unless, of course, our interpretation of inhumane measures is very different.
cyanydeez 2y ago
Except, his damage was done way after he was fired. Theyrevinhumane for more than just security
barfbagginus 2y ago
I hope your corporations all get taken down by persistent threats created by your own cruel policies, if you think any of that is justifiable. Literally just revoke the credentials. If you want to be extra, don't be surprised if you find your company source repos on the dark web, for Justice and Profit.

kstrauser 2y ago

I told my colleagues to do me a favor: if I'm ever let go for any reason, please terminate all my access immediately and diligently. It's for my protection just as much as theirs. If I can't get in, they can't blame me if something goes wrong down the road.

candiddevmike 2y ago
That is very threatening, why would you share this? If you truly think this way, you may want to consider a different career or look internally to figure out what makes you think this way. EDIT: I thought the "If I can't" portion read "If I can" in parent's comment. Disregard, sorry parent.
- r2_pilot 2y ago
  Some people work in regulated environments with audit requirements.
- ilikecakeandpie 2y ago
  Right? Just take the L and look for a new job
  - stetrain 2y ago
    I don't see how that's incompatible with wanting your access revoked on termination to avoid accusations of wrongdoing.
- landryraccoon 2y ago
  Emotions aside, isn’t it just sensible security policy to delete all permissions and invalidate all credentials of a terminated employee as soon as possible? Any other approach would be exceptional.
  - snotrockets 2y ago
    Both sensible, and required by many compliance frameworks.
- akira2501 2y ago
  > That is very threatening It's just creating "plausible deniability." > or look internally to figure out what makes you think this way. That's easy: Sarbanes-Oxley.
  - kstrauser 2y ago
    For me, HIPAA. I do not want access to a single resource or record that I don’t require to do my job.
- cko 2y ago
  Just because someone wants plausible deniability doesn't mean they're considering doing something wrong. They could just not want to be even considered a candidate for blame. For example, if I was ever asked to babysit someone, I would want them to install a camera pointing at me at all times, for my sake and their peace of mind.
- stetrain 2y ago
  What's threatening? I read that as just wanting their access removed as per policy/procedure, with no special treatment, because that both protects the employer from potential tampering and the employee from accusations of such tampering. I don't read any implied threat that they actually intend to or think they might do something harmful, just wanting a CYA in the same way the company wants one.
  - kstrauser 2y ago
    That's exactly it. I'm not asking them to save me from temptation or anything like that, or to provide me an alibi ("ok, you're locked out now wink"). I want them to do the right thing for our mutual benefit.
  - warunsl 2y ago
    Pretty sure they read "If I can't get in, they can't blame me if something goes wrong down the road." as "If I can get in, they can't blame me if something goes wrong down the road." That's the only interpretation that sounds threatening.
    - kstrauser 2y ago
      Ohhhhh, that makes much more sense now. If I read it that way, I'd also think I was a creep. Yep, they confirmed it.
- kstrauser 2y ago
  It's called being a grownup. If I worked for a restaurant and was fired, I'd give them the keys immediately. If someone unlocked the door and stole stuff later, hey, look at someone else who still has the keys. I don't. It's the same here. If I'm fired from a tech job, the company should do the right thing to protect themselves and lock me out right then and there. It's not because I -- the real me, not the hypothetical villainous me -- pose a risk to them. I wouldn't hurt an ex employer under any circumstances because 1) that's a bad thing to do, and 2) I don't want to be in jail. It's more that best practice dictates they do this. There's no benefit to them whatsoever in allowing me into systems I no longer have a legitimate need to access. And again, this also protects me. If I'm long gone and something suspicious happens, talk to their current employees, not me. I don't want to access to their stuff, and I couldn't even if I wanted to. Edit: Ah, honest mistake. I could see why you'd think that given the misreading.
- exe34 2y ago
  who's threatening whom?
- gooseus 2y ago
  I was working at a medium sized accounting software firm over a decade ago when I was called into the CEOs office and sat down for an interrogation. Apparently they had setup their Exchange server poorly and I'd had access to any number of mailboxes (including the CEOs) and other folders that I wasn't supposed to have access to. I was completely unaware of this access, but was being directly accused of having access confidential information. I insisted, truly, that I wasn't aware of the access and hadn't looked at anything confidential, but they tried to tell me they had proof that I had accessed email I shouldn't have. At this I got upset and demanded they show me this proof, which they couldn't do because they didn't have any, but I'm guessing they thought I had seen some stuff and they could get me to cave it if they pretended they had proof. Anyways, I didn't get in any real trouble because I wasn't intimidated, but it damaged the relationship and I ended up quitting a few months later. Now I feel the same way as OP, I don't want to be in a position where someone can make a plausible accusation of misconduct, you could be totally honest and still end up railroaded just for being in the wrong place at the wrong time. CYA.
- freehorse 2y ago
  If I work in a place where the data security practices are abysmal, where we have not been hacked and ransomed/extorted purely because nobody has bothered, I would definitely want to make sure that my access to any systems is revoked once I am no longer employed. I would not want to be anywhere close to a ticking bomb.

bitmasher9 2y ago

A more humane and complete way of handling this is to provide severance that is contingent on a smooth off boarding.

deleted 2y ago
[deleted]

ratg13 2y ago

He didn’t do anything malicious until half a year after his termination. This is a failure of the company. An inhumane offboarding would only encourage this.

jamesrr39 2y ago

Well, revoking credentials isn't inhumane. You can fire someone humanely and without compromising security.

hot_gril 2y ago
Was gonna say, they can bid you farewell without giving you access to stuff.

oneplane 2y ago

The reason of the measure you are describing is incompetence. But what happened here was a lack of: proper off-boarding, basic controls, and basic security hygiene. Unless, of course, our interpretation of inhumane measures is very different.

cyanydeez 2y ago

Except, his damage was done way after he was fired. Theyrevinhumane for more than just security

barfbagginus 2y ago

I hope your corporations all get taken down by persistent threats created by your own cruel policies, if you think any of that is justifiable. Literally just revoke the credentials. If you want to be extra, don't be surprised if you find your company source repos on the dark web, for Justice and Profit.