News for hackers. Stuff that matters.
Re:Goodbye Auth0 by ianhawes on Thursday February 15, 2024 @08:52AM (#39382682)
The lesson here is that once an employee or contractor is terminated, you remove all access to internal infrastructure. That's it. That is the lesson.
Re:Goodbye Auth0 by rglullis on Thursday February 15, 2024 @09:03AM (#39382797)
Then your company is still susceptible to being destroyed by any random employee.
Re:Goodbye Auth0 by dylan604 on Thursday February 15, 2024 @10:24AM (#39383768)
Potentially, yes. Someone could go nutty before being dismissed, and it just be Tuesday. That's why there's things we often refer to in this industry as backups. If it is just a software bit of mischief, you should be able to recover from that without too much down time. s/disgruntled employee/ransom ware/ and it's really no different.
Re:Goodbye Auth0 by makeitdouble on Thursday February 15, 2024 @09:16AM (#39382955)
Not "terminating" your employees and having meaningful conversations on how it goes after they know they're let go helps a lot.

That forces the employer to come up with actual explainations someone can digest, and gives the employee time to be rational and plan the pivot.

There will still be ugly stories, and preemptively removing accesses will be needed in some cases, but that's by far the exception and not the norm, and we usually know when that will be the case.