The Business Protector

I came across an article on The Register about an individual in California who was sent to prison for over 5 years for hacking into his former employer’s network and destroying data. Now there’s nothing wrong with the sentence and fine; the guy did wrong and deserves to be punished.

But there’s one VERY important question that hasn’t been answered:

How in the world did the guy get back into the network after he resigned? Why wasn’t he locked out?

Nobody seems to have addressed this question, but had the company had a solid termination plan and implemented it, the outcome might have been different (even worse: this was a medical records company. Who is holding THEM accountable for not properly protecting their client’s data?).

To make it even more personal, how about YOU? Do you have policies and procedures to deal with former employees? If not, may I make a few suggestions that might help you get started on creating them?

First, when you know that you are going to dismiss an employee or that the employee is going to quit, disable their accounts. Delete them as soon as you’ve walked them out the door (more on that in a minute).

Assign a supervisor or manager to escort the individual until they leave the premises for the last time.

Isolate the individual. Take them to a private office. Talk to them and ensure they know what is going on, what your termination procedure involves, and that they understand exactly what’s going on.

Have them review any computer user agreements and/or non-disclosure agreements to ensure that they know what they can, and cannot, do in relation to company data. Ensure that this agreement clearly states that they are no longer allowed access to company data and networks!

Ensure that any data under their control has been transferred to the right person. Do not let them do it; instead, somebody else should do it while the terminated individual gives any verbal instructions.

Ensure that all company property (access badges, identification, etc.) has been returned.

Notify Human Resources to ensure that they are aware and so that they can get involved, as necessary.

If the person had administrative rights on any systems or networks or used a shared account (never a good idea), ensure that all passwords are changed before the individual leaves the company.

That should be enough to get you started. Remember, your goal is to protect your Business, and thinking through (and perhaps even doing a “dry run”) your procedure is the start. If you wait until you need to terminate somebody, it’s too late, and you stand a good chance of forgetting to do something crucial. While the former employee may pay (as this one did), YOU will still have to deal with the consequences.

It’s always better to take proactive steps to protect yourself.

–Tom

I came across this post where somebody wanting to do good apparently did it the wrong way. They wanted to raise some money for a children’s cancer charity — Candlelighters — but were doing so in the form of an auction that featured artists’ reproductions of DC Comics characters.

Apparently Warner Brothers is the owner of the intellectual property rights for those characters (I didn’t bother to check this out) and stepped in to have the auction shut down, leaving the auction organizer in a bit of a bind and the cancer charity with a bit less cash than they might have had.

I can’t blame Warner Brothers. If they own the intellectual property rights, they have the right and obligation to protect their rights. And a lot of people are thinking, “Gee, Warner Brothers, what a heavy-handed thing to do!”

Let’s take a step back and look at this for a moment.

Let’s suppose that the auction organizer had taken YOUR trademarked and copyrighted items, reproduced them, and was selling them without asking first (that last point is important; it appears as if this step never took place). As a fellow business owner and holder of intellectual property rights, you’d probably do the same thing, i.e. move to have the auction shut down. And to be honest, I’d probably take similar action.

Hey, charity is a good thing (I sponsor two children via Children International — PLEASE consider sponsoring a child!), and being generous and helpful is a part of our mission while we are here on this planet. That’s why I included a link to the Candlelighter’s site; you can make a donation, if you wish (NOTE: I have not evaluated the charity but posted the link anyway because they are approved to receive donations via the Combined Federal Campaign, which at least means that they are an official charity, and from Thomas’ post, they actually do help people). Heck, you can even go to Amazon via the link on the Candlelighters’ home page and buy some stuff there — they’ll get a small commission when you purchase (another win-win, eh?). That’s a great thing, and I hope that you’ll at least take a look at their web page.

On the other hand, Warner Brothers acted properly, even though it appears to be heavy-handed.

What would I do if my stuff were being sold from a charity auction? Pretty much the same thing… If I didn’t want my name and company associated with the auction and/or the charity, I’d have it shut down in a heartbeat. If I liked the cause, I’d still consider my actions carefully, simply because I depend on business revenue to earn a living, and if I allow one person to use my property for a charity auction without prior coordination and permission, then I’ve set a new standard that could quite possibly lead to LOTS of charities doing it, thereby diluting my brand — and my ability to pay my bills.

Having said that, if somebody came to me BEFORE the fact and told me what they wanted to do — which is the way it should be done — I’d at least listen to them (at least right now). I could gain some great publicity from it, perhaps some new customers, along with the knowledge that I made a tiny bit of difference in somebody’s life.

So Thomas, your heart is in the right place (and this post is made with a prayer for Ben), and I sincerely hope that you find some way to help Candlelighters. And I’ll be watching your blog!

–Tom

P.S. — VitalSecurity, while I normally agree with you, I can’t this time. (it was my daily check of your blog that tipped me off to this). While Warner Brothers does seem to be coming across heavy handed here and could have handled it in some other manner, remember that as computer security professionals, we are obligated to uphold intellectual property rights. Otherwise I love your blog and what you’re doing; thanks, and keep up the good work.