What happens when an IT Administrator leaves the company?
In these troubled economic times, it is unfortunately all too common that one or more members of the IT team find themselves leaving their employer. There is a significant risk to any business when this happens because IT administrators are typically holders of high-level privileges which allow them to:
- Delete or modify user and computer accounts and groups
- Access sensitive and secured information
- Expose backdoors and network vulnerabilities to attack from third parties
- Create privileged accounts, and grant privileges to other users
Even if the administrator leaves on good terms and does not attempt any retribution on the former employer, their departure can leave security weaknesses and potential problems which cannot be cleaned up by simply deleting their user account:
- Service Accounts: most organizations have highly-privileged service accounts which run key services such as central file backup, anti-virus software or central auditing and reporting. Service account passwords are usually outside the scope of password change policies, because they are not used by any real user. However, the IT team often knows the passwords for these service accounts, and do you really want that knowledge on the streets?
- Orphaned Permissions: just because you deleted a user’s account doesn’t mean that all permissions assigned to that account get removed from file servers. The Access Control Lists for files and folders are typically full of “orphaned” entries for deleted user and group account SIDs. These NTFS security harder to manage and might even affect performance.
- Local Administrator Accounts: all servers and workstations have a local account database which defines the privileges of non-domain users on that computer. IT administrators sometimes use them to fix problems or install Windows components while the computer is not connected to the network, and they are also a commonly-used backdoor used by hackers. Like Service Accounts, if a member of your IT team leaves with knowledge of local account passwords, you could be at risk.
So, what can you do to mitigate these risks? There are a number of activities we recommend:
- Change ALL passwords regularly! This includes Service Accounts and Local User Accounts. ScriptLogic’s Security Explorer makes this process easy and fast, with its centralized, multi-threaded, agent-less technology.
- Managing a strong password policy and regular changes increases the help desk burden when users forget their passwords and lock themselves out. And if the IT team is smaller, the last thing you need is more help desk calls! Desktop Authority Password Self-Service gives users a secure way to fix this problem themselves.
- Clean out orphaned permissions from all Access Control Lists. Again, Security Explorer is the perfect solution and performs this operation with just a few clicks.
- Keep track of unused user accounts. Amongst its many other capabilities, Enterprise Security Reporter can report on user accounts which have not been used for 30 or 90 days or more, so you can clean out old accounts which are not being used.
These are a few recommendations for cost-effective ScriptLogic solutions that will help you keep your network secure in the event that an IT administrator leaves who knows where all the keys are kept!
