Scenario: Internal audit finds 4 IT staff who resigned 6-18 months ago still hold active accounts on the company ERP and VPN – one with admin rights. No damage detected yet, but this is an extremely dangerous backdoor. Immediate actions and what to audit?
1. Emergency revocation: within 24 hours
(a) Disable immediately all accounts of resigned staff (ERP, VPN, email, subsystems) – do not wait to verify “whether used”; lock first. (b) Rotate passwords of shared/service accounts the ex-staff knew. (c) Revoke issued digital certificates, tokens, API keys. (d) Reconcile the full system-account list against current headcount – close every orphan account. With lingering admin rights, top priority: check for hidden accounts/backdoors created additionally.
2. Retrospective audit: anything abnormal in 18 months
(a) Extract login logs of the 4 accounts over 18 months: times, IPs, actions – hunt anomalous logins (odd hours, odd IPs, bulk downloads). (b) If post-resignation access is found: assess what was done (viewed, copied, altered, deleted?) – grounds for reporting (unlawful network access/use – Articles 288, 289 Penal Code) and damages claims. (c) Verify data integrity: any data altered/deleted while accounts stayed live. (d) If customer personal data was accessed – meet notification duties under Law 91/2025.
3. Fixing IT offboarding
(1) Mandatory offboarding checklist: last working day = all-accounts-disabled day (automated via HR-IT integration if possible). (2) Least privilege – nobody holds admin beyond job needs; shared admin accounts banned, each admin individually identifiable for tracing. (3) Quarterly reviews reconciling system accounts with headcount. (4) Post-termination confidentiality clauses + handover minutes confirming access revocation.
Frequently asked questions
First action on finding an ex-IT admin account still live?
Disable all resigned-staff accounts immediately (do not wait for verification); rotate shared-account passwords they knew; revoke certificates/tokens/APIs; hunt hidden accounts/backdoors. All within 24 hours.
Should I audit 18 months of logs?
Yes. Extract login logs of lingering accounts: times, IPs, actions – hunt anomalous post-resignation logins. Unlawful access found is grounds for reporting (Articles 288, 289) and damages claims.
What does proper IT offboarding include?
Last day = all-accounts-disabled day; least privilege, no shared admin accounts; quarterly account-vs-headcount reviews; post-termination confidentiality + handover minutes confirming revocation.
This article is pending review by the QA Council before publication.
This article has been quality-reviewed by the FLAW AI Legal Council