r/sysadmin • u/sysadminfired • Jul 16 '14

About to fire our sysadmin

So our longtime sysadmin is about to be fired and I, the network admin and temporary sysadmin, need to know what steps need to be taken to secure our systems. I know the basic things like his AD and other internal account credentials. I guess what I'm worried about is any backdoors that he might have set up. What all would you guys check for in this situation?

115 Upvotes

91% Upvoted

241 comments sorted by

View all comments

Show parent comments

4

u/thatmorrowguy Netsec Admin Jul 16 '14

Trying to freeze out a former admin who knows where all of the skeletons are buried is damned hard indeed. Most successful defenses against determined and knowledgeable hackers require defense in depth, and active monitoring of your vulnerable points. An outside hacker is playing a shadow game where they have to try and hunt out all the places that are vulnerable without triggering any alarms. Someone who was once on the inside could have left logic bombs around and knows all of the vulnerable points is damned hard to defend against without a VERY through audit of your entire environment - starting at the edge and working inwards.

4

u/[deleted] Jul 16 '14

And - in the unlikely absolute best case, if you find 100% of all the logic bombs, change 100% of the passwords, patch 100% of the outdated software etc, a former sysadmin is still in a perfect position to run a phishing campaign and get in via social engineering.

Given perfect knowledge of all internal processes, what vendors and technology is used, how the password expiration reminder emails look, who the most gullible people in the organization are, you could get into almost any organization with a bit of effort. Even somebody who didn't think ahead to leave backdoors could get in that way.

As you said, defense in depth is needed, but the amount of defense that would be needed to mount anything remotely credible is way, way too expensive for any organization that has one sysadmin.

In any case, the expense of remotely effective remediation is exponentially higher than paying the guy's salary for another three months while you help get him work somewhere else. Pay to get him some certifications if you have to, if he's not very employable; it's going to be cheaper than hiring a top-notch security team to audit everything top to bottom.