Any time an employee leaves their place of work, the employer will conduct an exit interview. Unless the employee is let go, in which case there\u2019s not usually a need. The now former employee moves on to their next opportunity, but the business isn\u2019t done yet. There are still procedures that have to take place for legal and compliance reasons, not to mention the security problems that can happen. Especially now, in the midst of the coronavirus pandemic where every business employs remote workers, it is vital to follow employee exit procedures and remove access when someone leaves.<\/p>\n\n\n\n
First, let\u2019s forget the pandemic. Let\u2019s pretend that life is a pre-pandemic \u201cnormal\u201d for businesses. When an employee is hired, you enter their information into your human resources system. You add their name, address, date of birth, SSN, email, salary information and position. As the employee continues their tenure, any disciplinary action or commendations earned will be documented there. The employee\u2019s position dictates what internal systems they have access to and how deep that access goes.<\/p>\n\n\n\n
The longer an employee is with a company, the more likely it is that their position changes and their access needs change. If that employee ever leaves the company, regardless of the terms, any and all credentials they created must be stripped of access. No system can be left untouched because every system is an access point. If that access is not removed, it doesn\u2019t even have to be the ex-employee who gets into your system. Their information and passwords could be recycled at their new place of business or on social media where they were the victim of a hack. <\/p>\n\n\n\n
Now, think about all of that taking place in the pandemic era. Work from home, the shift to remote work, increased the strain of IT departments in every business. Infrastructures, systems, machines are all strained from the sheer number of people logging in from home. Think about that former employee and the type of access they have to your business, which now extends to their remote location. What happens if you don\u2019t do anything with that access? What happens if you just let them go and forget they were ever hired?<\/p>\n\n\n\n
A prime example of what can happen is showcased by the Post Rock Water District in Kansas. Earlier this month, Wyatt A. Travnichek, a former employee of the water facility, was indicted. He allegedly logged in to the public water system, remotely from his home, with the intention of shutting down safety processes that make the water safe to drink. The incident is said to have happened in March 2019, at which time Travnichek was an ex-employee. Part of his job duties while employed included logging in remotely to monitor the plant after hours.<\/p>\n\n\n\n