Managing Human Resources: Termination Procedures

In this excerpt from Chapter 6 of The Little Black Book of Computer Security, author Joel Dubin provides an outline of security measures to take when terminating an employee.

The Little Black of Computer Security

By Joel Dubin     150 pages; $19.95     29th Street Press

In this excerpt from Chapter 6 of The Little Black Book of Computer Security, author Joel Dubin provides an outline of security measures to take when terminating an employee.

You do the best to hire the best, but even then, employees sometimes need to be terminated. Regardless of whether the reason is performance-based or due to business losses, you should employ the following safeguards to protect your IT environment:

1. Review all your termination procedures with the legal and human-resources departments, and obtain
    their approval.

2. Take the following steps prior to terminating an employee:
     2.1. Inventory all systems, networks, applications, and data that the employee has access to.
     2.2. Check whether any unauthorized or rogue hardware or software exists on the employee's systems.
     2.3. List all the employee's user and administrative accounts.
             2.3.1. Particularly note any administrative accounts that include special privileges.
     2.4. Check whether any orphaned accounts exist, and if so, trace their ownership. If they are no longer being
             used, shut them down.
     2.5. Coordinate the termination date and time with the IT-security, building-security, and human-resources
             departments. If possible, plan for a time when the system will not be busy, so the IT staff can disable
             the employee's accounts without distractions.

3. Quickly take the following steps at the moment of termination (before the employee is out the door,
    if possible):
    3.1. Remove all physical access devices (badges, ID cards, access tokens, keys, and card keys) from the
           employee's possession.    
    3.2. Remove any network-access software, such as VPN clients and
            RAS software, from the employee's possession.
    3.3. Lock out access to the employee's workstation.
    3.4. Cancel and remove all system and network accounts.
    3.5. Escort the employee from the premises.

4. After termination, be sure that the IT staff checks the logs of the
    previously inventoried systems for any entry attempts by the
    terminated employee.
    4.1. Add rules to any Intrusion Detection Systems for checking the
           same.

5. If the person was employed either by the IT department or as a
    software developer with access to restricted systems, create
    backups of network configurations and crucial applications or data. In case of sabotage, you will then be
    able to quickly rebuild the damaged network or system.

Download Chapter 6

Recommend your favorite security titles

Learn more about baking security into business processes

Visit the Information Security Bookshelf for more excerpts

More Information

This was first published in October 2005

Dig deeper on Security Awareness Training and Internal Threats-Information

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close