From Ryan Groom,
Your Guide to Business Security.
FREE Newsletter. Sign Up Now!

This phase deals with the immediate areas of concern in the event of a termination. These areas also represent the largest security hole that could be exploited within an organization. While they may seem obvious it is imperative that all items be actioned if applicable.

Physical Access:

• All access to any building the company has access to should be revoked. Ensure any support staff are aware the terminated employee is no longer allowed on the premise to thwart a social engineering attempt to gain entry to the premises
• Start immediate backups of key software and server configurations and store off site to prevent tampering
• Have employee return any equipment they have
• Initiate a company wide password change – regardless of position
• All combination locks must be modified
• All safe combinations must be modified
• All keys must be returned and all locks changed (in case the users has made a copy)
• All key cards, swipe cards and PDA’s must be returned immediately (remember that many PDA’s have internal access to an organization’s infrastructure).

Remote Access:

• Disable all portal entry (such as SharePoint of Citrix)
• Disable all VPN access associated with the user account
• All remote access must be terminated. This can usually be curtailed by disabling the terminated employees’ user account. But many users have multiple accounts and could have back door accounts on servers.

Infrastructure Access:

• Active Directory Servers
• File and Print Servers
• Mail Servers
• Network access