Re: Removing FIred admins

["Paul J. Morris" <mole () morris net>]

If you rely in the integrity of information in databases, I would also
advise reviewing all trigger code present in your databases and
examining how you assess the integrity of your data.  There are some
very nasty things that someone able to write code within a database
could do to make your data gradualy degrade over time (or leak).  More
broadly, assess what sorts of executable code you might be restoring
from backups as part of your data after you have reinstalled all of your
operating systems.
-Paul

On Fri, 13 Feb 2004 16:54:21 +0100
Benjamin Schweizer <besh () gmx net> wrote:
> I think you need to do some risk management. There are some steps to
> keep in mind (from a security-point of view), I'd follow this order:
>
> 1. change the logins
> 2. ensure that he has no more physical access
> 3. inform his colleques (protect against social engineering)
> 4. check your logs / increase the log level / install additional ids
> 5. reinstall the affected systems from scratch (run an audit if not
> possible)
> 6. fix security holes that he could/should know
> 7. ensure that your other admins are upright (be fair)
> 8. watch your competitors if he sold information
> 9. break his password, if you have no access to your data
> 10. prepare for the future

-------------
Paul J. Morris  
Biodiversity Information Manager, The Academy of Natural Sciences
1900 Ben Franklin Parkway, Philadelphia PA, 19103, USA
mole () morris net  1-215-299-1161

Attachment: _bin
Description: