Article posted: Jun 19, 2017
By Anders Adolfsson, Technical Consultant
Keeping your admin rights current is a necessity today. Verelox, a provider of dedicated KVM and VPS servers based in The Hague, Netherlands, is a good case in point. The company recently endured a devastating data outage after a former administrator deleted all customer data and wiped most of the company's servers, per Bleeping Computer.
As of this writing, Verelox was reeling from this data breach and had shut down its servers to recover compromised customer data. And it was completely avoidable! If Verelox had deployed an identity and access management solution, the IT administrator or HR director could have quickly and easily revoked the former employee's access rights before he or she left the building. This is a common practice that secure organizations, like governments and banks, have deployed for years. It's time for SMBs to seek out affordable solutions to protect their data.
Unfortunately, as damaging as it was, the Verelox breach is not an uncommon occurrence.
According to a report from IS Decisions, 10 percent of ex-workers have accessed a former employer's system and one-third of ex-employees still have access to a previous employer's system. As alarming as these statistics are, managing employee access privileges is often an overlooked step when employees leave a job.
Think about the implications. If the former employee is a member of the IT department, there could be significant access issues. IT typically has more access rights than other employees (sometimes even more than the CEO). IT executives are also the keepers of network passwords. Unfortunately, passwords are the gifts that keep giving access to former suspect employees or outsiders. In many cases, passwords are not changed regularly. They also can be shared externally, easily granting access to anyone typing the correct keystrokes.
So, why depend on passwords when affordable two-factor authentication, like smartcards and RFID tokens, are readily available, easy to deploy and even easier to manage access privileges? If two-factor authentication systems are deployed within the enterprise, access rights become the purview of the human resources department. HR can easily revoke privileges and confiscate the smartcard or token before the departing employee leaves the building. This creates a level of security and collaboration between HR and the IT department and adds another layer of security that is already used daily in multinational corporations.
To learn more about deploying an identity and access management system and protecting your organizations from costly insider breaches, https://versasec.com/vsec-cms.php.