86
Rogue IT worker gets seven months in prison over $200,000 digital rampage — technician changed all of his company's passwords after getting suspended (www.tomshardware.com)
submitted 1 year ago by to c/sysadmin@lemmy.world
11 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 17 points 1 year ago (4 children)

Suspended or fired. We usually jump on this pretty fast. You never know what people will do. Easy enough to just disable accounts. Weird.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 16 points 1 year ago (3 children)

    It’s usually harder to do for admins. They’re usually the ones who do the suspending.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 12 points 1 year ago (2 children)

    The only way that works in practice is to either have a second admin who gets the order while the first is talking to their boss, or you have a non-technical person with a break glass account that can do it while the admin is in that meeting.

    I've had to be the second admin on more than one occasion and it sucks to be the one disabling your coworker/friend when they get fired, but it's part of the job.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 1 year ago

    Thankfully, nothing like that has happened here, but we have a break glass account that only 2 people know of, and it's locked in a safe. Also, my place has gotten so good at firing people they know how and when to do it to minimize risk. Like end of day when they are all packed up, and if its a really high up person, top admins are contacted prior and held on standby to disable everything as soon as the word is given. This includes admins. If they are remote, they will normally lock them out of the laptop first and make sure access is gone before letting them know.

  • permalink
  • fedilink
  • source
  • parent