Hacker News Reader

Comment by zokier | Hacker News Reader

Wiped by ex-admin, or by the ineptitude of current admins that can't maintain proper exit procedure?

Ok, I'll bite. If you are an admin generally you have God powers over everything within your umbrella. If things are going south with you and your employer and you're a giant asshole you can most certainly use your God powers to quietly open firewall ports, install software in dusty "corners" of networks, etc. We can all armchair quarterback this but in the end humans make mistakes and beyond that the presence of actual malicious intent by someone with keys to the whole kingdom makes the detection and/or mitigation difficulty factor go up significantly. It's real easy to make righteous proclamations about other people's misfortune when it's not you.

I'll admit, my tone might have been tad overly poisonous (too much internet for me..).

I'd agree that defending against malicious admins is really difficult. We have really little context to go by here, but I think there is important distinction to be made if the malicious actions (planting backdoors or whatnot) were done while the malicious actor was still employed or after their employment was terminated. Proper exit procedures protect against the latter, but generally are not that effective against the former.

> but in the end humans make mistakes

And it is useful for us outsiders to highlight the real mistakes so that we can learn from them, because that is really the biggest value of stories like this for the majority of people who are not directly impacted.

Exactly. Happened to my shop on my watch. Fired a contract admin... about a week later the network went to hell. Unfortunately I couldn't nail the bastard, but at least we found and closed the back door.

The current admins ineptitude did not wipe anything. Yes, with better procedures this could possibly have been prevented, but the current admins are not the malicious party.

My most favorite of all razors is Hanlon's: "do not attribute to malice what can be explained by stupidity"

Not sure how that's applicable here? Seems like an ex-admin deleting things is pretty clearly malicious...

He's saying the current admins are stupid for not investigating every possible route an ex admin could take for tanking the business.

Don't necesarrily attribute the error to the ex-admin, because the current admins were stupid enough to let it happen. Yes, the ex-admin is wrong and shouldn't have done it, but it is a crime of opportunity.

If I leave $20 on the sidewalk the thief is wrong for stealing it, but it is partially my fault for being stupid enough to leave $20 on the ground.

This is way more like throwing away your old roommate's belongings because they didn't change the locks when you moved out. Anyone would take a $20 bill on the ground with no way of knowing the previous owner. Not everyone would maliciously destroy someone else's property just because they had access. Yes, current admins could and should have done more to prevent this. However, this goes way beyond opportunity and firmly into malicious intent.

I'm not sure I can agree with the reasoning here. An ex-admin, who had the conviction to wipe an entire company's database, probably wouldn't have been stopped by exit procedures.

This can easily happen to anyone -

    5PM Friday - $admin and $ceo have a fight
    6PM Friday - $admin decides he's had enough with $company and $ceo, and wipes everything
    7PM Friday - $admin is fired

Where are your exit procedures now? Are the current admins stupid for not having the foresight that $admin and $ceo's fight would have resulted in the worst?

Well, for one thing, if you can't ensure that a given privileged person can be locked out of your systems quickly, you have a problem to fix. This should be a 1-minute operation.

Note that I don't know the details and am making assumptions that may be wrong about the case in question, but in general, if you can't deny access quickly to any given account, you really want to fix that. Not just because of rogue ex-employees - what happens when $important_person's account is compromised?

> This should be a 1-minute operation.

No. It's easy to revoke access to a user. An admin is different - an admin can install whatever he wants to give him backdoor access. Or a timebomb.

Yes, but backdoors/malware are a different question. I was talking about authorized access - LDAP, ssh keys, etc.

Detecting unauthorized software from a rogue privileged user is a different problem with very different mitigations. It is a great topic that I'm personally interested in, given that I'm implementing controls for that, but I wasn't discussing that.

Not following/having a proper exit procedure for employees with a lot of access is being negligent. Wiping servers of your ex-employer out of spite is criminal (and being pretty bad at that whole being a human thing).

Was he an ex-admin at the time he did this? It's not made clear here.

Who says he used his credentials and didn't leave and use a backdoor?

Reply on news.ycombinator.com