Rogue System Administrator Faces 10 Years In Prison For Shutting Down Servers, Deleting Core Files On the Day He Was Fired (techspot.com)

Joe Venzor, a former employee at boot manufacturer Lucchese, had a near total meltdown after he got fired from his IT system administrator position. According to TechSpot, he shut down the company's email and application servers and deleted the core system files. Venzor now faces up to 10 years in prison and a $250,000 fine. From the report: Venzor was let go from his position at the company's help desk and immediately turned volatile. He left the building at 10:30AM and by 11:30, the company's email and application servers had been shut down. Because of this, all activities ground to a halt at the factory and employees had to be sent home. When the remaining IT staff tried to restart them, they discovered the core system files had been deleted and their account permissions had been demoted. Eventually the company was forced to hire a contractor to clean up all of the damage, but this resulted in weeks of backlog and lost orders. While recovering from the attack was difficult, finding out who did it was simple. Venzor was clearly the prime suspect given the timing of the incident, so they checked his account history. They discovered he had collected usernames and passwords of his IT colleagues, created a backdoor account disguised as an office printer, and used that account from his official work computer.

Comments

this is why you need two factor auth

[Anonymous Coward]

it keeps one person from gathering other people's accounts.

Also, accounts need to be reviewed and any unexpected accounts need to be investigated.

Re:this is why you need two factor auth

[MichaelSmith]

An admin can still override authentication. Whats needs is to bring the new admin in before you sack the old one. He removes admin privileges from the guy being sacked. That, or isolate the system from the outside world for a while but in this day and age that may be impossible from a business perspective.

Re:this is why you need two factor auth

[Anonymous Coward]

in this case, they did remove admin privileges from the guy being sacked, he used other people's accounts to access things remotely.

Two Factor authentication could have blocked that by preventing him from impersonating other admins.

Re:this is why you need two factor auth

[Anonymous Coward]

A good admin will have a Canary that he has to "feed every day" or else the whole company blows up. Isolate my system and access to my system at your own risk. Do not make your admin mad. Make sure to feed him with a steady stream of shares of the company and nice benefits.

Also, other guy talking about two factor: Cloud is just someone else's computer. Two factor is just someone else's authentication. It's not a magical panacea. Most things can be overridden and even in cases when they can't be, it's really just trusting another company to provide some authentication credential.

Re:this is why you need two factor auth

[aaarrrgggh]

Hell, if you want to be vengeful, you don't do it from a computer, you do it from a IoT device on the network. You can even make it a canary to take action when your account is disabled or something. But for gods' sake, do it in parts over a longer period of time... and give yourself a way to clear your mind and stop it!!

It is scary just how hard it can be to detect a rogue employee trying to sabotage you. There are only a few things you can actually do to limit impact to a reasonable level.

Re:this is why you need two factor auth

[Zontar The Mindless]

You're spelling it g-o-o-d but pronouncing it "evil and incompetent".

It's not your system--it's your employer's. If you feel that you have to make yourself "indispensable" in such a fashion, you're doing it wrong.

Re:this is why you need two factor auth

[Anonymous Coward]

If you want to be vengeful, thank your former employer for the job on the way out the door and ask for a letter of reference. Then go get a similar job at another company at a higher wage knowing you would never have gotten such a raise at your former employer's.

Re:this is why you need two factor auth

[onepoint]

very factual. ownership of the resource is the company, not the admin, the Admin is the manager of 1 of the many resources. such a simple concept but for years people don't get it. and it's in every industry that I know of.

Re: this is why you need two factor auth

[Anonymous Coward]

It neednt be so scary: if companies took the time to set up and regularly review audit trails, it would be much more difficult to hide a trojan canary. And if more companies were adept at exercising their disaster recovery plans, they would be able to recover from such a scenario much more quickly (hopefully, knowing to filter out any similar trojans in the backups)

Too few companies recognize the importance of DRPs until they've been put out of business

Re:this is why you need two factor auth

[Anonymous Coward]

How about teaching your users: under no circumstances does anybody else ever need to know your password.

You may have to replace a few brain-damaged software products so that the implied "including system administrators" can be made to stick.

Re:this is why you need two factor auth

[MichaelSmith]

Realistically you can't keep him out. He could have created a fallback account to use.

Re:this is why you need two factor auth

[Anonymous Coward]

I was once fired (purposefully, so I could collect unemployment benefits) from a network admin job. Afterwards, I was accessing their servers remotely to secretly do maintenance because I felt bad for leaving some of the good people I worked with. It was illegal for me to do so, but I was never caught. I can admit doing it now because it was so long ago and I no longer live in the same country.

Re:this is why you need two factor auth

[pnutjam]

That's not just a problem in IT. Ask the CEO who's company it is. Usually they don't own it, but they act like they do.

Re:this is why you need two factor auth

[uncqual]

Which works until the admin is in an induced coma for a couple of days after a really bad accident. The canary dies and at the very time the admin would be hoping for sympathy and some leeway due to her long upcoming recovery, she is instead fired and eventually ends up in prison and bankrupt and unable to ever again get a job in IT (or, perhaps anywhere).

Re:this is why you need two factor auth

[gravewax]

He was an admin, and he obviously had little to zero ethics or morals. had they had an MFA solution I am sure he would have just disabled it for a few accounts or simply registered an MFA token to one of those accounts that he could have taken with him. MFA does not solve the rogue administrator problem completely

Re:this is why you need two factor auth

[dbIII]

That sort of canary happens by accident instead of design when systems grow "organically" with all kind of weird interdependancies, especially on very low budgets. I started work at a place like that once and my initial goal was to remove every little quirk that needed feeding every day so that I would be free to spend time at the beach every now and again.
I seem to remember some years ago stories of suppose dead man switches and sabotage would come out when the reality was fragile systems carefully looked after by people who never got to train a replacement.

This story is of course different - but ten years? Corporate crime with consequences of shutting down companies completely doesn't get ten years, serious embezzlement doesn't get ten years - why should this sort of corporate crime get ten years?

Re:this is why you need two factor auth

[Szeraax]

This is what regular ad account audits are for. If you don't trust, then reset service accounts password after you remove his admin access.

Re:this is why you need two factor auth

[MichaelSmith]

And who will do the auditing? I know places like this. The IT manager is king and nobody knows what he does.

Re:this is why you need two factor auth

[Szeraax]

Where I am, IT manager is not king. If I see something out of place, I can go directly to the CEO. I create the audits and then the CIO will audit it. We do this quarterly. We compare all users to a list of current employees from HR to verify that we don't have any "accidental" users not disabled / deleted.

Perhaps we are unique that we actually do try to take security seriously.

Re: this is why you need two factor auth

[Anonymous Coward]

So you need 2 factor... for a company to fire you.

Nowadays the reason of being fired is a lottery, sure you could be terrible, but 50% of the time is poor mgmt or industry downturn.

Quid pro quo is all I have to say. There's truth and justification to any action, otherwise you're mentality ill.

Re:this is why you need two factor auth

[arth1]

I create the audits and then the CIO will audit it. We do this quarterly. We compare all users to a list of current employees from HR to verify that we don't have any "accidental" users not disabled / deleted.

... except for any ones that you might have removed from the audit before handing it over.
Quis custodiet ipsos custodes?

Re:this is why you need two factor auth

[arth1]

A good canary won't rely on the owner hand feeding it; but will accept food from authorized automatons.
If the user's account is closed, the canary will no longer be fed by the golems, and will peck the neener button. But the user going on vacation or to hospital won't cause the account to be closed, and the golems continue feeding the canary.

Re:this is why you need two factor auth

[Anonymous Coward]

And that's why what I hand off gets audited by him. If I have a special account, he will see it during his audit.

Re:this is why you need two factor auth

[arth1]

And that's why what I hand off gets audited by him. If I have a special account, he will see it during his audit.

If you hand it to him, you also have the ability to modify what gets handed to him.

Even if he shoulder rides you, it's easy to hide things like accounts. Like replacing commands like cat and cp with ones that grep out what you don't want seen.

And how do you know that formeruser1 doesn't have backdoor access to currentuser2 or automatedaccount3 that bypasses the authentication scheme? The ways to set up that are endless.

Re:this is why you need two factor auth

[bool2]

"why should this sort of corporate crime get ten years?"

Because "computers."

Re:this is why you need two factor auth

[Dr. Evil]

Infosec teams often have direct read-only access to equipment and audit logs to central servers, with alerts on use-cases such as turning off logging, modifying account permissions etc. etc. In some circumstances even command history is logged.

It's hard to imagine why infosec would conspire to hide an account. If it has a good reason to exist, the case can be made to the CIO.

It might be possible to circumvent this stuff if you have physical access during a network outage, but your card access logs would still be in the system, it just might take a couple years for it to turn up when people investigate "how did the back door get there?" and it may be enough to put you in prison.

Re: this is why you need two factor auth

[Anonymous Coward]

The problem is that DRP training and audit trail reviews cost money. This cost can cause the company to be put out of business too. On one side, you have small cost the company is paying all the time. On the toher side, you have huge costs the company may be paying in the future if it is really unlucky. Both costs can cause the company to fold.

Re:this is why you need two factor auth

[Anonymous Coward]

Because nerds are the $BAD_MINORITY_STEREOTYPE of the professional world.

Re:this is why you need two factor auth

[arth1]

but your card access logs would still be in the system,

Who set up the card access?

Re:this is why you need two factor auth

[BarbaraHudson]

No, what needs to be done is to wait until someone who's generally regarded as a dick is fired, and then trash everything that same day while leaving no traces. Extra BOfH points if you do it while you're still working there.

Re:this is why you need two factor auth

[BarbaraHudson]

How about teaching your users: under no circumstances does anybody else ever need to know your password.

And the higher-ups who insist that they don't need passwords? Because it's "their" computer. even though it's not? And "passwords are hard".

Re:this is why you need two factor auth

[BarbaraHudson]

Like it's not possible to clone a card?

Re:this is why you need two factor auth

[BarbaraHudson]

So much for "taking ownership of a problem." Success is everyone's happy child, failure is a miserable orphan.

Re:this is why you need two factor auth

[BarbaraHudson]

Actually, the guy wasn't an admin - he was a help desk employee. Also, he won't be sentenced until June 6th, just over 2 months from now. A href=https://www.justice.gov/usao-wdtx/pr/former-el-paso-based-company-employee-pleads-guilty-computer-intrusion>From the district attorney's office

Venzor admitted that on September 1, 2016, after being terminated from his position at the company’s help desk, he logged onto the company’s network through an administrator account and shut down the company’s email server and application server while deleting systems files essential to restoring computer operations.

Why a help desk monkey was able to create accounts with admin privileges is a question left unanswered. Also, it was Windows, because if it were any of the *nixes, it would be root privileges if you really wanted to do serious destruction and still be able to cover your tracks. Non-root users simply can't modify or delete everything at will, including all system logs.

Re:this is why you need two factor auth

[BarbaraHudson]

Sorry for not checking the link.

Re:this is why you need two factor auth

[BarbaraHudson]

He was a help desk employee. Realistically, he shouldn't have been able to create admin accounts all over the place.

Appearing before Senior United States District Judge David Briones, Venzor pleaded guilty to one count of transmission of a program to cause damage to a computer. By pleading guilty, Venzor admitted that on September 1, 2016, after being terminated from his position at the company’s help desk, he logged onto the company’s network through an administrator account and shut down the company’s email server and application server while deleting systems files essential to restoring computer operations.

But of course, both the original submission and the register claim that he was a sysadmin. Probably because a hell desk jockey shouldn't be able to create sysadmin accounts in the first place. I wonder who left their password on a post-it stuck to the bottom of their keyboard this time.

Re:this is why you need two factor auth

[HornWumpus]

Basic asymmetry. It's the admins responsibility/problem but someone else's property.

Re:this is why you need two factor auth

[gweihir]

Just makes this attack a bit more difficult. Even if many people on the business side are putting their heads in the sand about this, it remains true that there is no protection against competent system administrators except keeping them happy.

Re:this is why you need two factor auth

[onepoint]

Funny that you say that. I do an accountability chart, so I know when it's my fault, when I am related to the fault, or when I am not accountable. Makes my life much easier. While we are all accountable to a point, I use it to know where the limits of liability are.

Re:this is why you need two factor auth

[Hognoxious]

The chart says it's not your fault.
A CxO says it is.

Whose fault is it?

Re:this is why you need two factor auth

[onepoint]

Thanks for asking, hope this helps and guild you correctly:
Most people don't have a true, who gives a fuck what you say attitude and or my life does not depend on this job lifestyle so... /start/
well, here is my accountability chart.
note that the fault is
A = mine
B = not mine

a= I accept the blame for this.
keep mouth shut tight as can be, CxO will piss and rant then walk away

b= you can tell, being that the fault is not mine, BUT however, if you let me solve it, and I succeed, I want a 38% pay raise
CxO says " how about I let you keep your job"
me = you are funny, so about the problem and my pay raise, do I send this in a memo and CC personnel or whom?
shut up tight as can be

I've always been amazingly good at not having fear when asking for something that is justified ( or just a great gamble), if you got fired then they really did not see the value in you. BTW 38% is a great number to start with, weirdly enough people argue intensely or accept it as fact. I use it exclusively.

Re: this is why you need two factor auth

[Anonymous Coward]

If they're in hospital for long enough, their account might still get disabled and re-enabled when they come back.

Re:this is why you need two factor auth

[ArmoredDragon]

The higher ups failed from an infosec perspective, but not even related to passwords.

Put simply: The guy was fucking help desk. How the fuck did he get domain admin permissions to begin with? Because that's what he would have needed to do all of this. You don't even give help desk people the ability to reset passwords or unlock accounts, rather you delegate that to a few people in a given department so that they can authenticate the user by e.g. speaking with them face to face, and even then they can only do that for people within their own department; certainly not IT staff.

Help desk people shouldn't have access to anything except for the ability to remote in to a user's PC and do things for them, and even then only if the user explicitly permits it. If help desk can't resolve an issue that way, then that should be escalated to tier-2, aka desktop support, who should have higher permissions but even then still shouldn't be domain admins.

Re:this is why you need two factor auth

[Dr. Evil]

I've never seen a DC without 2 factor authentication. The second factor usually being a fingerprint, and implemented in a mantrap. If your rubber finger doesn't work, and you don't have a good explanation for the guards, the doors won't be opened until the police arrive.

Re:this is why you need two factor auth

[Dr. Evil]

The datacenter provider.

Re:this is why you need two factor auth

[BarbaraHudson]

Nobody has said anything about data centers. This wasn't one, and access cards to regular buildings can be faked.

Re:this is why you need two factor auth

[Dr. Evil]

In April 2016, their MX changed to outlook.com. He was fired Sept 1.

How do you know it wasn't a DC?

Re:this is why you need two factor auth

[BarbaraHudson]

I know it wasn't a DC because I actually read the articles and the statement from the department of justice. Shame on me for cheating so blatantly, doing a bit of research and using real facts.

Re:this is why you need two factor auth

[rickb928]

Mantraps are incredibly rare in the U.S. business world. First, they present a significant evacuation hazard, and a true criminal might not hesitate to pull the alarm. Second, not many businesses have the resources or the need to go that far. Those that do, they have other ways

I did a short gig for a recognizable firm, rack & stack bunches of servers. Our orientation to the data center included pointing out a standalone cabinet we were instructed to avoid. As in, do not touch, brush up against, or walk to closely to. Cameras, touch-sensitive cabinet, pressure-sensitive flooring. Well marked. And we were told why - this was the PKI insfrastucture, one of several redundant sets. This company literally has knowledge and information as their product; tangible, manufactured products are merely the expression of that knowledge and information. Losing that would be catastrophic for them, causing decades of diminished profits and ultimately ending in a permanent loss of capability. This bit of infrastructure, certificate servers and such, were critical to their data security. No touch. We were advise to not linger nearby too long, which was not a problem, first because this was out of the way, close to the security office, and not a place we needed to go. But, the point, this datacenter did not have mantraps. They did, however, have the ability to lock the gates and deploy security staff if needed. They drilled for this, thankfully not when I was there. My friends that work there tell me their security is somewhat stricter than where I work, and it's onerous here. But necessary. And we have mantraps for the machine room, and I'm told a fire alarm will release them into the tender loving arms of Security. Somehow. Just don't worry.

And second, because I can take the hint. Touch nothing that isn't your responsibility.

It was a great gig - except for the fist day, when bad news led to screaming people running through the halls, and people being fired and rehired because they laughed in the cafeteria. Other than that, I loved being asked to do stuff I wasn't actually hired on for. And no, they did not ask me to work on anything PKI. I was not offended.

Re:this is why you need two factor auth

[david_thornley]

I'd be in real trouble. I have a great deal of difficulty getting fingerprint readers to recognize me. I managed to get my iPhone to recognize my fingerprint about once or twice a year, and finally disabled fingerprint access.

Well

[Anonymous Coward]

He certainly justified the decision to fire his ass.

Re:Well

[stooo]

He should have deleted the files a little bit later, tho :)

At a boot manufacturing facility?

[xevioso]

I guess he did not like getting the boot.

Re:At a boot manufacturing facility?

[craXORjack]

He a make'a tha server notta boot!

Re:At a boot manufacturing facility?

[K. S. Kyosuke]

When the remaining IT staff tried to restart them, they discovered the core system files had been deleted and their account permissions had been demoted.

I don't understand what kind of boot manufacturing facility cannot boot their servers. Surely not one that I would buy my boots from!

Re:At a boot manufacturing facility?

[Anonymous Coward]

were the boots wooden? That makes it sabot-age!

Re:At a boot manufacturing facility?

[msauve]

"I guess he did not like getting the boot."

No one does. But burning bridges is never a good response. And if you want to strike back, the proper and accepted channel is the legal system.

The article first says "fired," which in modern vernacular implies "with cause," but then later says "let go," which is half way between being fired for cause and simply "laid off" for reasons beyond an individual's control (e.g. wrong position at the wrong time).

I've been laid off a couple of times. Both times, got a new position in months - first time with the same employer, second time (during the 2008 recession) with a company which was closely affiliated. All good, no complaints. Shit happens (and severance helps avoid digging into savings). In either case, I'd have screwed myself if I had lashed out and burned bridges.

To do so within an hour of being dismissed indicates an extreme lack of maturity and professionalism. Sending a "fuck you" email to the CEO a week later might have been a rational, albeit ineffective, vent. He probably deserved to be fired even if he was only laid off. And he deserves criminal repercussions for his actions, which significantly affected people who were completely innocent of the decision to dismiss him. He hurt his co-workers more than the company itself. Karma can be a bitch. Don't make life-changing decisions without at least sleeping on it.

Re: At a boot manufacturing facility?

[nitehawk214]

James Bond: "I gave him the boot."

Re:At a boot manufacturing facility?

[RuffMasterD]

Staff discount was the sole reason he applied for the job though.

Re:At a boot manufacturing facility?

[lsllll]

Wooooooooossshhhhhhh!

Re:At a boot manufacturing facility?

[AmiMoJo]

The servers were UEFI, their boots only work with the BIOS.

Re:At a boot manufacturing facility?

[Anonymous Coward]

were the boots wooden? That makes it sabot-age!

We've all seen Star Trek: The Undiscovered Country but thanks all the same

Re:At a boot manufacturing facility?

[luis_a_espinal]

I guess he did not like getting the boot.

Which is kind of fucked up because getting the boot once or twice is part of life.

Re: At a boot manufacturing facility?

[kaatochacha]

I'm thinking more..
Removes sunglasses, "He got the boot'.

YEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH!

What a coincidence!

[Anonymous Coward]

What a coincidence! When I deleted core files from our servers that ended up being the same day I was fired too.

Re:What a coincidence!

[stooo]

Not really a good strategy imho.

Re:What a coincidence!

[Anonymous Coward]

Deleting critical files before getting the boot - understandable, that company has to protect the crown jewels (that you just dropped). Next time your supervisors will do some due diligence before hiring - assuming they're not getting the boot as well. As a bonus, you may get an extended vacation in your parents basement. Be sure your game console is current before doing this.

Deleting critical files after getting the boot? First class skulduggery! [paraphrased from the article] That's like an attempt to assassinate the Queen (while she's on the loo) using backdoor loo keys stolen from the Royal Guards workshop. Or maybe he installed a new secret backdoor into the loo. All whilst simultaneously detonating some barrels of gunpowder (or C4) under the Tower of London, destroy the Crown Jewels, and remotely breaking all the locks at Parliament and Buckingham Palace. Maybe the Guy Fawkes mask and BOFH links on his Windows Desktop should've been a clue.

Lol

[Anonymous Coward]

That's the wrong way to go about that. If you're going to go to that length you might as well make it a subtle surprise for the future. And think about it, if you're really such a good employee that a company would be devastated to lose you it should be evident when you leave by the fact that you're no longer doing the job.
Do the best job you can. Sometimes that works out to be unappreciated, but then you get to move on to a more lucrative position and the company gets to try to find someone to fill your shoes.

at the boot factory

[OutOnARock]

.....find someone to fill your shoes...

I see what you did there

huh?

[Anonymous Coward]

Why did he still have access to his official work computer after he was fired?

Re:huh?

[Anonymous Coward]

There is this brand spanking new technology called remote access. You might not find anything about it though because it's so new, but you could try google, you might find something about it.

Re: huh?

[Anonymous Coward]

And my company whitelists issued hardware to the VPN, now. In 2007, when remote access was first being rolled out, I learned I could download a trial copy of our VPN software on my home WinXP box, and two factor authenticate to our work network. I had access to the corp LAN, printers, everything. I self-reported, and they locked things to MAC addresses after that.

Re: huh?

[Anonymous Coward]

You're confused if you think MAC addresses are somehow secure.

Re: huh?

[Anonymous Coward]

Seriously. Small company work here; every time we let someone go, I was terminating access the moment they were on the phone or in the office.

Common sense shit, yo.

Re: huh?

[mmdurrant]

You have to know an existing valid MAC. You have a 1 in 4 billion chance of guessing the right one and if there is any kind of IDS/IPS in place, you're gonna get shot down after a few tries.

For this use case, they are secure.

Re: huh?

[Anonymous Coward]

Except that the guy was sysadmin and had access to the whitelist...

Re: huh?

[Anonymous Coward]

Except that the guy was sysadmin and had access to the whitelist...

Nowhere does he say he was sysadmin, and nowhere does he say he has access to the whitelist...

Re:huh?

[gweihir]

Does not matter. If he had not, he could have placed a dead-man-switch.

Disguised as an office printer

[PPH]

It all happened so fast, officer. He ran that way. He was short, beige and had a tattoo that said Lexmark.

Re:Disguised as an office printer

[Anonymous Coward]

"Any tattoos?"

"No ink."

Re:Disguised as an office printer

[toadlife]

"He was toned though."

at least he left them powered on.

[Anonymous Coward]

Anyone remember the dude that got the axe at PG&E a few years back??? Didn't he kill power to the datacenter or something like that???

Probably stale

[somenickname]

Those core files were probably stale anyway.

Re:Probably stale

[Anonymous Coward]

Those core files were probably stale anyway.

yea they could have used a better term for the OS files than that... My first thought was "so what??? they were core file for goodness..."

I don't quite get it

[93 Escort Wagon]

Are we supposed to be outraged or something? It sure sounds like the guy deserved to be fired - and, based on the actions he took after being fired, he deserves prison time and a significant financial penalty.

Re:I don't quite get it

[retchdog]

nah, everyone is supposed to rant and rave, and then they can run their sentiment-detection algorithms on the comment pool. it's kind of like a poll, but more participatory.

Re:I don't quite get it

[pellik]

We're supposed to be mildly amused. Not sure how much more you can expect from /. anymore.

Re:I don't quite get it

[hcs_$reboot]

Are we supposed to be outraged or something?

Based on what he did, no. However we'd like to get more information on how he was fired. Everyone needs some respect in that case, especially someone who has admin access to all systems.

Re:I don't quite get it

[Anonymous Coward]

Of course it sounds like so when he is not given an opportunity to defend himself. Like most "news" today It is a propaganda piece, telling us only one side of the story.

Of course it could be just like they report it with nothing more to add. But, how are we to know when the guy cannot say anything in his defence?

Re:I don't quite get it

[AmiMoJo]

Shouldn't have taken so long to fix I guess. VM restored from backup, base system installed fresh... But then again, maybe this is why they fired the guy.

Re:I don't quite get it

[Hognoxious]

While what he did was wrong, I'm sure there are a fair number of former replacement trainers who sympathise just a bit.

Re:I don't quite get it

[Anonymous Coward]

I think all such fines go to the state, not the company that was hurt. The justice system is nothing more than a racket itself.

His last words after being fired

[Anonymous Coward]

He said PC TRAY LOAD LETTER!
Most co-workers did not get the obscure reference
Nerd humor, they thought, when it was actually nerd rage.

It happens more than you think

[Anonymous Coward]

We had a programmer in out Dept that got the can a few years back. He wrote some production jobs that ran as root on many servers. We discovered a subroutine in the code that would 'rm -rf /' if his account was removed or went dormant for more than 90-days. Luckily we found it before the 90-day timer kicked in. We (as a group) decided to keep it to ourselves since we didn't want to see the guy get into any trouble...

Re: It happens more than you think

[Anonymous Coward]

Well that's dumb. He wanted you guys to get in trouble for letting it slip if you hadn't caught it...

Lucchese -

[Anonymous Coward]

gave him a cold boot?

Backups?

[sokk]

It's 2017. Everything should be running in VMs, and snapshots of those VMs should've been backed up. Guess the IT department wasn't up to scratch.

Re:Backups?

[Opportunist]

Catch-22: Who's in charge of backups?

Re:Backups?

[Anonymous Coward]

...Guess the IT department wasn't up to scratch.

What part of "Boot Factory" did you not understand???

Re:Backups?

[Anonymous Coward]

Oh, that's easy. The sysadm-- oh.

Re: Backups?

[Anonymous Coward]

The part where they have their own IT dept.
Don't they know India is more trustworthy than your nerd friend?

Re:Backups?

[MichaelSmith]

Everything should be running in VMs,

I am a VMS fan myself but I wouldn't recommend using it on a new project in this day and age. HP don't support it well enough.

Re:Backups?

[rtb61]

Kind of make you wonder who should be gaining a custodial sentence the wacko help desk dude or the crap sys admins, I mean, really, really bad sys admins. The help desk guy did, should only be a overnight fix. For them to claim damages the bulk of which is as a result of incompetence is kind of extreme. Sorry nothing more than a tiny bit of incompetent vandalism, the rest that is incompetent sys admins and the crazy help desk dude basically did management a favour in letting them know how incompetent their sys admins are. Help desk dude hacked you internet security team, wow, really embarrassing, too much porn and not enough planning.

Re:Backups?

[rtb61]

Whoops forgot the required car analogy. It was like the help desk guy cut them off and as a result of really poor management all four wheels fell of the car when they swerved due to no lug nuts, the front of the car dug into the road, the car then flipped and went off a cliff. Dude just cut them off, the wheels should never have fallen off.

Re:Backups?

[arth1]

It's 2017. Everything should be running in VMs

Including the host? And the host that the host runs as a guest on? And the host that the host that the host runs as a guest on?
In your world view, I guess it's turtles all the way down.

and snapshots of those VMs should've been backed up.

Right, because a sysadmin can never manipulate backups...

Re:Backups?

[BatGnat]

Backups were going too slow, so he redirected them to /dev/null

I always delete core files

[ooloorie]

They are a bloody nuisance and just take up disk space.

Re:I always delete core files

[DivineKnight]

Well, once they are loaded into memory, yes.

Re:I always delete core files

[Anonymous Coward]

^ doesn't know what a core file is

Re:I always delete core files

[Zan Lynx]

/vmlinux and /dev/mem are just wasting space. I deleted them and nothing bad happened. . .

Leave USA, work for another state

[Anonymous Coward]

This is the thoroughness expected of a well-planned attack, though it was obvious who did it in this case the actions remained effective. The cost of the lost business exceeds the potential gains from firing this man. His next career move is to investigate jobs at Mosad and other agencies for similar electronic attack roles.

Re:Leave USA, work for another state

[Anonymous Coward]

Mossad

Re:Leave USA, work for another state

[Anonymous Coward]

Are you suggesting this was part of a plot to get him hired by Hamas or other terrorist groups, as an IT administrator, wait until he's fired, and then strike by attacking their e-mail server? Is Bigfoot also involved somehow?

Btw, being a 'vested employee' has a completely different meaning when you work for Hamas...

Why the fuck would they care?

[Anonymous Coward]

Why the fuck would they care if he deleted core files? I mean, unless like... they were some sort of vital core files from crashes of products or something they were analyzing and debugging? But surely they have some sort of a backup system for diagnostic data they're working on like core files?

Re:Why the fuck would they care?

[Anonymous Coward]

But surely they have some sort of a backup system for diagnostic data they're working on like core files?

In what world is the admin not managing backups?

More info

[bobthesungeek76036]

http://www.kvia.com/crime/fbi-...

Re:More info

[BigBuckHunter]

http://www.kvia.com/crime/fbi-...

Thanks for that. Of note:

"a list of account usernames and passwords for network systems and services" -- Not of his coworkers.
"Venzor allegedly used a separate Lucchese network account named elplaser" -- Does not say he created it like the 1st article.

Strange that there is a delta in the information provided by the two articles.

Sloppy.

[Gravis Zero]

Come on, people, if you are going to get revenge on the company that canned you, you're supposed to set up a daemon on day one that checks to see if you have logged in the last month and then begins corrupting backups as they are made for the next 5 months, at which time it will execute a total system meltdown that results in total data loss! I swear, you youngin's know nothin' about properly destroying the lives of those who have wronged you! ;)

Re:Sloppy.

[old7]

The appropriate number of days since your last login, is 42.

Re:Sloppy.

[onepoint]

And while I know you are sarcastic, it's people that think in this manner that ruin people's lives for years. I Almost lost my company if it was not for my backup policy. I would do back-ups monthly myself on Saturday morning and retrieve the cassettes Sunday afternoon, take them home and store. an employee that I fired for doing something real bad did a time bomb on the payroll system and sent a system-wide delete. well long story short, 3 days of employee's working part time with note pads I got a basic restore done, then one system at a time did re-installs ... 2 weeks later we were back in business.

to this day I keep backup's of data, spare computer laptops just in case, and 1 month payroll and 1 month of expenses LOL never again I hope

if the business would have failed, it would have cost 38 people's employment and my business ruined.

safe to say, that I never let only 1 person handle backing up the systems ever

Re:Sloppy.

[buss_error]

I was accused of doing this at a former employer. I was fired for "job abandonment" and later that day some of their systems went down. Fortunately, it was easy to prove I wasn't responsible. There's no internet in the intensive care unit. (Which was why I didn't show up for work or call in sick.)

Now my medical alarm has a Pi attached that will tweet my family...and my employer.

They didn't offer to re-instate me either. Cool beans. I was about to quit anyway because they were not nice people. Always, but always, find someone that used to work somewhere and get the low down before you accept a job.

Re:Sloppy.

[sysrammer]

I hope you've been living comfortably on the proceeds from the lawsuit.

Re:Sloppy.

[arth1]

And while I know you are sarcastic,

He wasn't. He was joking. Sarcasm is a form of irony that targets one of the listeners/readers. This was neither irony nor did it target someone.

Re:Sloppy.

[Anonymous Coward]

I was accused of doing this at a former employer. I was fired for "job abandonment" and later that day some of their systems went down. Fortunately, it was easy to prove I wasn't responsible. There's no internet in the intensive care unit. (Which was why I didn't show up for work or call in sick.)

Thank god for living in a country where this is outright illegal. You cannot fire someone here without having good reasons, and not showing up one day isn't good enough reason for them to fire you on the same day. Even if it was a repeat offense they would have to talk to you BEFORE making a decision.

Re:Sloppy.

[Anonymous Coward]

Sarcasm is a form of irony that targets one of the listeners/readers. This was neither irony nor did it target someone.

Stop making things up. This is your own private definition of sarcasm. There is no need whatsoever for sarcasm to target the listener/reader.

Re:Sloppy.

[Gravis Zero]

And while I know you are sarcastic, it's people that think in this manner that ruin people's lives for years.

indeed. some people have not faced exceptionally emotionally stressful situations or do not know how to properly cope with strong emotions. At our core, we are still just animals that have only recently begun to act (slightly more) civilized.

Re:Sloppy.

[Anonymous Coward]

That's how I was taught. There are cron jobs and then there is "The Cron Job". Bonus points if you fake the logs to make it look like the CEO installed it.

Re:Sloppy.

[Anonymous Coward]

Cron job that's for smuck's. Use at to start the script at some point in the future because they will probably check the crontab, but >99% of Unix admins have no idea that at even exists. Extra bonus points for having your script clean up after itself. Did it once but there was *zero* chance of any blow back because the single file deleted which was deliberately not in any backup was a hacked version to bypass a parallel port dongle.

Re:Sloppy.

[Anonymous Coward]

Well, that's what you get for firing someone for the wrong reasons.. Usually people who are fired for the right ones do not feel the desire for revenge.

Asshole management is what destroys companies.

Re:Sloppy.

[buss_error]

Thank god for living in a country where this is outright illegal.

I take it you are not a United States resident.

Most of the places in the US, an employer can fire you for no reason at all. These are called "Right to Work" states. Mostly the laws are designed to prohibit unions. The laws run the gamut from outright prohibition (in the case of federal Air Traffic Controllers) to rendering them incapable of any sort of collective bargaining or effective operation (as in the case of Teacher's Unions thorough out much of the South of the country.) These laws are promoted mostly by the conservative or right wing political spectrum. Strangely, these same groups don't normally have any objection to strong unions for Law Enforcement workers. I'm not sure why a teacher can't have an effective union but a police force can. I am very aware that for someone not steeped in this situation that it makes absolutely no sense at all.

Re:Sloppy.

[buss_error]

I hope you've been living comfortably on the proceeds from the lawsuit.

In the state I reside in, the employer's actions were protected by state law. This is a "right to work" state, which allows for employee termination without cause and without notice. The only limit is the number of employees that can be fired at once, and that's a federal law. It doesn't protect a group smaller than 100 people.

Re:Sloppy.

[onepoint]

Firing anyone, for any reason, does not give them the right to damage business property.
And because your style of thinking, I keep making backup's.

Re:Sloppy.

[david_thornley]

"Right to Work" means not having to join a union under any circumstances. What you're talking about is "at will" employment. Legally, someone could come around now and fire me for bad fashion sense, or for no reason at all. (There are things I can't legally be fired for. Good luck proving one of them applied.) Similarly, I could grab my stuff and walk out. It's all legal (although I probably wouldn't get paid for unused PTO if I didn't give notice).

Re:Sloppy.

[Whorhay]

Blaming criminals for committing criminal acts is perfectly fine. Getting worked up because the criminal is particularly clever is just a waste of your time and energy. I'm glad to see that you have learned from that experience. The thing is though that it is people who think about how something like that could be executed that we should be putting to work on finding ways to secure IT systems against such threats. In the case of corrupted backups the easy solution is to test backups regularly so that the exposure is limited.

10 years in prison?

[Anonymous Coward]

Don't get me wrong, this guy certainly deserves punishment if guilty, but 10 years? Did any CEOs or politicians get 1 day of jail time for the 2008 financial crisis?

Re:10 years in prison?

[gweihir]

CEOs and politicians are not accountable for their actions these days. Their crimes are "to big to be punished".

Ha ha! dummy...

[Zurkeyon3733]

Remote DBAN and Bit Scrape the Drive... 8 Passes of Zeroing ought to do it... Zero Evidence. Literally! :-D

Re:Ha ha! dummy...

[toadlife]

With modern hard drives, one pass of zeros is sufficient.

Here's how...

[Anonymous Coward]

Buy him a nice bar of soap.

Help Desk?!?

[GoChickenFat]

This guy had that kind of access, and knowledge for that matter, as a help desk employee? The article is confusing but who puts a sys admin on the help desk with any ability to access all company servers in the first place?

...and I found my answer...a company that is dumb enough to run it's entire business applications from a single server. http://www.kvia.com/crime/fbi-... "Investigators learned that the server controlled the company's production line, warehouse, distribution center and its ability to take orders."

Re: Help Desk?!?

[Anonymous Coward]

Depends on the size of the company. "Help Desk" can essentially by the entire MIS / IT department; consisting of 1 or more employees. Obviously if it's just one, he/she would double as the sysAdmin as well.

Re:Help Desk?!?

[Anonymous Coward]

And a person dumb enough to do this shiat. I hope his life is forever ruined. He is nothing but a criminal and a small miserable being. Foock him and anypne else that thinks this is ever reasonable. Hopefully he gets shanked in prision.

Re:Help Desk?!?

[dbIII]

a company that is dumb enough

The answer is "small" not dumb. If there isn't a lot to do a single server can get the job done.
If I was in that situation I'd want to keep the server hardware up to date and have a working older server ready to turn on when something goes wrong, but I don't see that a single server was the problem here.

Re:Help Desk?!?

[AK Marc]

I've worked at places where the CIO was the only IT employee. A biased article looking to vilify could call him the "help desk guy".

Re:Help Desk?!?

[geekmux]

...a company that is dumb enough to run it's entire business applications from a single server. http://www.kvia.com/crime/fbi-... "Investigators learned that the server controlled the company's production line, warehouse, distribution center and its ability to take orders."

Uh, a company "dumb enough"? This "single server" is also known as an ERP system. And a shitload of large companies around the world run ERP systems. The dumb part is not protecting them with a valid DR strategy.

Re:Help Desk?!?

[GoChickenFat]

um...yes, worked on plenty of them for several companies - SAP, JD Edwards, etc. and it's not a requirement that they run on a single server - unless you count a custom cobol program running on a mainframe in the 90's but those were staffed with 24/7 "computer operators" who basically managed massive amounts of tape backup libraries. And what you're actually referring to needing is a business continuity plan (BCP) of which disaster recover (DR) is just one part of that plan. So given that, in this story the company should be looking at the "Director" as the next person to be fired for having absolutely no strategy. The Director clearly is incompetent at selecting and managing people. It's highly likely that a small IT shop like this was more concerned about the director's technical skills than his management skills and so this is the price to be paid.

Re:Help Desk?!?

[Anonymous Coward]

If your Production servers run on a single system, that *IS* a problem, because if *anything* happens to that system, everything goes down.

Never keep all your eggs in one basket, or at the very least have a tested plan in place to rapidly replace that basket should it be necessary.

Re:Help Desk?!?

[HornWumpus]

I've known a 'CIO' that had to get approval for any expense greater than $50.

He had negotiated the title in lieu of a raise. Moron. He was still just the 'computer guy'.

Re:Help Desk?!?

[Anonymous Coward]

Many "shop" type IT situations view IT as an expense to be managed.
It'll be common to staff everything with unqualified good enoughs and then call them helpdesk and have them do jr sysadmin work.
The real work will be done by contractors so the boss never need worry about his own lack of competence. At one place I worked, each outsourced contract exceeded most employee's salary

I know these types of shops exactly he'd probably been getting worked to death for low pay awhile.

Re:Help Desk?!?

[AK Marc]

10 years as one-man CIO, and he could get a job as a "real" CIO. Incompetence rises.

Re:Help Desk?!?

[HornWumpus]

Maybe for some people...not for him. Incompetence rises if they can play the part and speak the language.

False-flag op.

[Anonymous Coward]

See, it was one of the other IT employee who wanted some easy vacation time, and now had a Patsy to pin it on. Think about it.

Re:False-flag op.

[Anonymous Coward]

Precisely what I was thinking; the motive doesn't even need to be so elaborate; it could be just for teh LULZ. Hate your co-worker? wait for him to have a reason to blow up, then ruin his life by pinning some vandalism on his ass. Oh.. AND let the internet troll-court finish him, continuously.

Physical access

[ArchieBunker]

He had physical access. What good is a VM?

Lessons learned:

[Anonymous Coward]

NIGHTLY backups.

Re:Lessons learned:

[AK Marc]

Yeah, and anyone knowing things were so bad could have easily sabotage the backups. In my case, an incompetent admin set the last server to backup "over wright" So the only backup that worked was the one nobody cared about. And the backups were completed daily without error.

So an admin that is looking to cause problems could do so silently, even with nightly backups.

Re:Lessons learned:

[gweihir]

Indeed. There is no protection against a system administrator. A system administrator _needs_ the possibility to screw up everything in order to do his job, there is no way around that. Solution: Keep them happy, give golden parachute when firing them, etc. You know, the things that CEOs get for doing nothing nearly as valuable.

Could have been worse for him

[Anonymous Coward]

People have been killed for doing much less that what he did.

And he did this in the USA, to a company in Texas, that was founded by Sicilians.

Nope

[s.petry]

We should mostly agree that 'don't be stupid' is a good rule to follow. Though we man rant about having similar feelings about past employers, just not enough to take any such actions.

Exit Interview

[DivineKnight]

I suppose the exit interview did not go well.

Curious writings though: "What happens though if the person being fired is an IT system administrator in charge of managing those accounts?" "Venzor was let go from his position at the company's help desk and immediately turned volatile."

Something's missing. They call him an IT system administrator in one sentence, then say he was a part of the company's help desk in the next. Collecting usernames and passwords, this I see, and an account 'disguised' as a printer...however, the kind of damage he has caused speaks of privilege escalation. Was he one System Administrator among many, or was he the Domain Administrator? Perhaps a Network Administrator? These types aren't typically referred to as "help desk" personnel.

And what exactly did they say to him, when they fired him? (Note the lack of the words "let go") What was the incident for which they were firing him?

Re:Exit Interview

[qzzpjs]

Something's missing. They call him an IT system administrator in one sentence, then say he was a part of the company's help desk in the next.

A lot of companies probably have their help desk people fix passwords for users which is enough power to cause a lot of damage.

Re:Exit Interview

[gravewax]

for smaller or medium size businesses it is not uncommon for admins to also be helpdesk people.

Re:Exit Interview

[arth1]

and an account 'disguised' as a printer...

If they used a really old Unix server, chances is that the lp user account didn't have a password by default.

That was pretty much my thought when reading this.

[Anonymous Coward]

As much as I think the guy deserves some jail time over it, I think a year or two, some public shaming, and cash restitution to the company covers it just fine.

How much time would he have gotten for trashing the office? Assaulting a co-worker? What about arson? If it is less than 10 years, then the 10 year sentence is too harsh.

As to this company, they deserved what they got. If a help desk guy is getting access to accounts allowing him to wipe your system, even by accident, then your in-office security is far too lax, and a number of other IT personnel need to be losing their jobs over this, because they obviously weren't doing *THEIR* jobs, or those passwords wouldn't have been collected, his work computer would have been locked out immediately upon his firing, and the server would have required a password known only by the head sysadmin and either the CEO, or his immediately junior sysadmin in case something happened to him. Anything less than those three and the company full deserved the damage they got and should use the lesson to ensure they take their infosec seriously next time, along with replicated backups and periodic (monthly or more often) restorations onto a duplicate system to verify functionality in case a catastrophic failure happens, whether manmade, electronic, or natural disaster in nature.

Ten years? Less time if he'd punched out his boss

[dbIII]

It seems the hype and hysteria over computer issues is still ongoing.

Remote access

[dbIII]

Realistically you can't keep him out

You can, I've been there and done that during a layoff in a place I'd never been to before. You disable all remote access until you are certain what is at the other end of each remote access method. One time the former sysadmins had VPNs to their home machines (in 2002 so not as common as today), which was totally legit when they had a job but completely undocumented, yet it still wasn't hard to stop until it was clear where everything was going.

Re:Remote access

[MichaelSmith]

In a professional environment yes, but in some places the sysadmin would be most of the IT department, leaving nobody to shut down remote access. Many places these days rely on cloud services for B2B and retail. Shut down the internet and you stop the business. You could shut down remote VPN access but who is to say he hasn't got his own version of a daemon running somewhere?

Re:Remote access

[ShanghaiBill]

You disable all remote access until you are certain ...

You can never be 100% certain. Otherwise, we wouldn't have events like "Pwn2Own" ... and those don't even have a malicious insider involved. Give any decent hacker a year of root access on a system, then there is no way that you can ever be "certain" that it is free of backdoors without a complete wipe and re-install.

You should read this: Ken Thompson: Reflections on Trusting Trust.

Re:Remote access

[dbIII]

without a complete wipe and re-install.

Which is what was effectively done on the gateway - a new box doing what the old one was supposed to do. It's a long way from impossible. Sometimes it's not even difficult.

Re:Remote access

[arth1]

You can, I've been there and done that during a layoff in a place I'd never been to before. You disable all remote access until you are certain what is at the other end of each remote access method.

I'd fire you if you sprouted such nonsense.

A sysadmin doesn't have to use the known remote access routines, but can add his own hidden ones.
If a sysadmin leaves and can't be trusted, any machines that are not air gapped must be considered compromised and reinstalled (from media the sysadmin never had access to). You have no way of knowing what backdoors exist, including ones that are initiated from the inside, not the outside.
For every way of blocking a former superuser, I can think of three other ways for him to get in.

Re:Remote access

[ls671]

Yep indeed, you need layers and layers of IDS watching each other and some qualified humans to make sense of the reports (e.g. yet another layer of unknown working for the company teams). This has become ridiculously expensive to manage lately but remains the only way to go IMHO.

Re:Remote access

[Anonymous Coward]

Gateway is only the most easy target. It is not enough to reinstall the gateway. You really must reinstall everything which can receive (either directly or indirectly) any data from the outside. And there may be also "time bombs" which will go off when their watchdog is not refreshed in specified time (e.g. in a week).
Really, the only way to safeguard against a determined sysadmin which was fired is to reinstall everything. Preferably even replace hardware (especially all the hardware which has flash-able firmware).

You cannot be 100% certain in practise without reinstalling all software and hardware.

Re:Remote access

[Anonymous Coward]

Even air gaped machines can contain "time bombs".

Re:Remote access

[BarbaraHudson]

But none of the machines should be open to being destroyed by a help desk jockey, which is the job this guy was doing when he was fired. He was NOT a sysadmin. Just that the people writing the headlines and stories puffed it up by assuming (wrongly) that the guy was an admin. Sort of like Tony Blair and Colin Powell with their WMD stories. Or Trump with his brain-fart of the day tweet.

Re:Remote access

[dbIII]

A sysadmin doesn't have to use the known remote access routines, but can add his own hidden ones.

Hence the word "all".
I very much doubt that you are in a position to fire anybody, but thanks for the insult based upon your failure to even read to the end of the sentence you quoted.

The thing about computer networks is if you control the way in and out you can just drop any packets that are not on a list of what should be allowed. It's time consuming and disruptive but you can block everything and allow remote access on a case by case basis.

Re:Remote access

[arth1]

Hence the word "all".

Followed by "remote access", which limits it to a very small and inadequate subset of what needs to be done to secure a system.

i can give you a real life example; A company's main web server log statistics program had been modified to look for specific phrases in error logs. When one phrase was found, it would make a tunnel to the outside from the server doing the log analysis. When another was found, it would escalate privileges through another internal compromised command and wipe the system.
How would your closing of all remote access accounts safeguard against something like this?

On another system, the common "cat" command had been compromised, When called as root, it would add another account, and if passwd or shadow was an argument, it would hide the account from the output.
How does your closing remote access help when the system itself reinstates it?

The answer is that you can't. You have to treat the system as it is still owned by the former admin until and unless it is wiped or completely airgapped.

I very much doubt that you are in a position to fire anybody,

Actually, I am. But it's always better to weed out the irresponsible cocksure ones during interviews and background checks.

Re:Remote access

[dbIII]

which limits it to a very small and inadequate subset of what needs to be done to secure a system.

So you want to shift the goalposts from step one of keeping someone from the outside from getting in the way they normally do to something else? Fine, but don't whine at me about it. Are you going to attack anyone who suggests changing a password as well?

Actually, I am

And you would fire someone who solves a problem over someone who ignores it or doesn't even consider it? How about using your brain here instead of farting your "gut feeling" all over the page.

Why did you so viciously attack a suggestion I made about one of the many things that should be done and get so fucking personal about it? You do not appear to be someone worthy of any sort of responsibility if you do that when you are on the clock.

Re:Remote access

[dbIII]

i can give you a real life example

I've been called in places to help deal with such real world examples - it's called a rootkit. The only way to be sure with those is reinstall and to look at the (preferably removed) owned system disks with knoppix or similar.

Re:Remote access

[arth1]

Why did you so viciously attack a suggestion I made about one of the many things that should be done and get so fucking personal about it?

Because you did not present it as "one of the many things", but as the countermeasure that will stop a former admin, with an angle that the you saved the day by doing so. Your subsequent post reinforced a view that you thought it would stop a former admin.

It won't, and suggesting it's more than a theatre rule in the case of admins is ignorant, reckless and needs to be pointed out.

Re:Remote access

[arth1]

What's generally known as root kits are generic. These are bespoke and tend to exploit existing processes and procedures.

The only way to be sure with those is

Drop the "with those", because you have no idea whether they exist or not, so you have to presume they do.

The question becomes one of "do you trust your former admin?" If you do, you can get away with the useless chicken waving for management, like closing accounts and blocking known methods of access.
If you don't, air gap all machines, reinstall from new media, code audit, rebuild all software, et cetera. Including devices like printers, routers, NAS devices and other people's PCs.

This can be a very time consuming and expensive endeavour, compared to making sure you part with an admin on friendly terms and with ironclad clauses in the departure contract prohibiting leaving clandestine modifications, and giving the admin time to revert any such without repercussions before he leaves.

Re:Remote access

[dbIII]

air gap all machines

You said you would fire me for a similar suggestion - that of initially shutting down any way in.
Why is it good advice from you and a firing offence for me?

Re:Remote access

[dbIII]

Because you did not present it as "one of the many things", but as the countermeasure that will stop a former admin

That was in your own mind since it does not appear to be in any of my comments above.
Perhaps you can quote where I suggested it was the only thing required instead of making yourself look ridiculous with baseless claims, assertions that you are so important that you can fire people and threats as to what you would do to someone who offered a piece of advice.
I really don't understand why you are foaming at the mouth over an obvious suggestion of an obvious first step. If you control all the ways in and out you can block people. How are they going to ssh in when ssh is blocked entirely and then only opened up to a checked list of valid addresses? How are they going to use teamviewer when your web proxy blocks all asp pages and their old PC isn't even connected to the network? If you have a real reason to worry your web proxy can block everything apart from to trusted workstations inside the network, trusted because they are being checked one by one. If you have a real reason to worry you drop all encrypted traffic (I'm anticipating your next rant by stating the obvious here) until you don't have to worry.

Throwing up your hands and saying it can't be done and you'll fire anyone who tries is somewhat petty and ridiculous IMHO. You just do not seem to understand that you chop the complex problem into simple chunks and solve it one bit at a time - instead of just giving up.

that the you saved the day by doing so

I didn't save the day, I just took sensible precautions in a tense situation. It wasn't even difficult. It would be harder now with everything and it's dog coming in through port 80 - but that just means a bit of temporary pain when that gets blocked as well if it's really seen as necessary.

Re:Remote access

[arth1]

You really should stop digging yourself deeper.
You just told everybody that you don't know or understand the huge difference between airgapping and "disable all remote access until you are certain what is at the other end of each remote access method."

Re:Remote access

[rickb928]

"Even air gaped machines"

Thanks for that. My content filters at home just went into full Defcon 1 alert.

Re:Remote access

[Anonymous Coward]

No you really can't. unless you are going to do a complete teardown and rebuild every time you have a sysadmin leave their is never any 100% certainty that they haven't created a backdoor.

Re:Ten years? Less time if he'd punched out his bo

[Baron_Yam]

I would like to know what the sentence would have been if he'd taken a baseball bat to the server and backup media instead of using electronic means.

Backups yes. "Everything in VMs", no.

[dbIII]

That's a very 1990 way of looking at things in server space (IBM etc was doing it then). Zones (AKA containers) are a less wasteful way separate things and unlike recent VMs there is some consideration of security.
"Everything" is a bad word to use when describing something outside of your own workplace in terms of what applies inside yours.

In the MS world VMs are the bandaid solution to poor resource management by an OS. Outside of the MS world there is less need and very frequently you want a piece of hardware (or a cluster) to be dedicated to a single task - so a VM is pointless in that situation apart from convenience of backups (which once again outside of the MS world is trivially easy).

Re:Ten years? Less time if he'd punched out his bo

[dbIII]

Better example - probably just a warning and good behavior bond instead of a possible ten years.

Re:Ten years? Less time if he'd punched out his bo

[gravewax]

He didn't get 10 years, 10 years is the maximum he CAN get under the law. though this arsehole looks like he probably deserves the maximum

postal

[Anonymous Coward]

at least no one lost there lives in these type of incidents though destructive non the less.

Hitting his boss would do less damage (seriously)

[Anonymous Coward]

Unless he somehow killed or permanently disabled his boss taking out their operations for several weeks did more damage and impacted more people. Our businesses and, to some extent our lives, have become so dependent on computers that even relatively simple attacks against computers can have devastating effects. For example, imagine I went into a hospital's case management system and put a trigger on the database to double all new doses on insert. It's a "simple" attack but could have very deadly consequences. I know that's in a completely different league from what happened here but it illustrates the point that you have to measure the crime by its impact, not by the level of effort (or violence) in its execution.

Obvious solution

[stooo]

The obvious solution to the rogue admin problem : Use Linux
A study has shown that when using Linux, admins are 47,5% happier on average.
By using Linux you can nearly guarantee that you will not have a sour relationship to your admin, and probably don't have to be in this situation :)

Re:Obvious solution

[Lorens]

The obvious solution to the rogue admin problem : Use Linux

Flashback to the Slashdot of last century!

Re: Obvious solution

[SuperDre]

You really are ignorant.. who says this company wasn't using linux? And if his firing has anything to do with him being able to use linux.. sorry, but you're just an ignorant moron for suggesting that linux makes you a happier admin, a real admin doesn't give a shit what system he has to use...

Re: Obvious solution

[Anonymous Coward]

It was on windows.. Read the story before commenting next time.

The BOFH lives!

[Anonymous Coward]

Bastard!

Re:The BOFH lives!

[BatGnat]

It wasn't him, it was the solar flares.....

Re:Horrible spelling on Slashdot, again -- not

[Lorens]

A random AC said:

It's "rouge". Rogue is what old-fashioned women apply to their faces so they'd look healthier.

Umm, no. You got it backwards, and (for once?) the Slashdot editors do it better than the random contradicting AC.

"Rouge" (French for "red", same Latin origin as "ruby") is the cosmetic, and rogue (from Latin "rogare", "ask"/"beg", same origin as "interrogate") is a excellent word to describe the guy in this story. Just because it's on Slashdot doesn't mean it's *wrong*.

I don't care about correcting AC who will probably never see this, but some poor guy might read that and believe it...

Re:Backups yes. "Everything in VMs", no.

[geekmux]

That's a very 1990 way of looking at things in server space (IBM etc was doing it then). Zones (AKA containers) are a less wasteful way separate things and unlike recent VMs there is some consideration of security. "Everything" is a bad word to use when describing something outside of your own workplace in terms of what applies inside yours. In the MS world VMs are the bandaid solution to poor resource management by an OS. Outside of the MS world there is less need and very frequently you want a piece of hardware (or a cluster) to be dedicated to a single task - so a VM is pointless in that situation apart from convenience of backups (which once again outside of the MS world is trivially easy).

A VM, is pointless?

In the real world you properly assess risk and impact, define an SLA, virtualize all critical servers in VMWare, and run encrypted snapshot backups multiple times a day, written to tape nightly and kept offline as well as offsite, away from any risk of "rouge" attack. Proper snapshots capture the entire server (including those pesky "core system files"). Had they used and protected VMs properly, it would have likely resulted in little more than getting admin rights back and restoring the entire environment within a day.

While the rogue admin deserves punishment, the real crime was this clusterfuck of a DR strategy. Whoever signed off on that shit should also be fired.

Oh, that DR solution is too expensive? I wonder how much weeks of backlog and lost business cost. Maybe they should have invested more in IT instead of their Polo team...

For Starters You Should Delete Old Accounts

[onkelonkel]

I used to work at a $Very Big Transportation Company from 1982 to 1998. They are now clients of our company. Earlier this year Transportation Company needed to give me access to some of their systems. My old username and account, from 1998, were still in their systems.

Re:For Starters You Should Delete Old Accounts

[__aaclcg7560]

I got laid off from eBay in 2009. A few years later I came back to eBay to do a PC refresh project. When I needed to fix a problem for a user and got prompted for an admin password, I typed in the old password and it worked. When I brought it to management's attention, they changed the admin password — and gave me the new admin password. When I had a job interview at eBay a few years ago, they were taking security more seriously as they were hiring remediation techs to fix the Heartbleed Bug.

What's the benefit of throwing him in jail

[rsilvergun]

to society? If you just want punishment for punishment's sake I guess there's that. He's a first time offender, the damage was minimal. Nobody got hurt, and they just needed a few contractors (read: Cheap Windows guys) to sort it all out. "Core Files" here if you RTFA means he broke the OS. He should get slapped with restitution equal to lost sales and the contractor hours + a little for pain/suffering (very little) and sent on his merry way. Maybe get some court mandated therapy. By the sound of it this was a spur of the moment/rage thing. Throwing him in jail is a waste of everyone's time and money and might unnecessarily destroy his life.

Re:What's the benefit of throwing him in jail

[ScentCone]

By the sound of it this was a spur of the moment/rage thing.

You're right, he's a genius that should be free! Because his "spur of the moment rage thing" involved him, in the hour after he was fired, to invent a time machine that allowed him to go back and make a collection of his co-workers account/password information and set up his back doors. What kind of person who has just been fired has the presence of mind to invent time travel in only an hour? A frickin' GENIUS, that's what kind.

Oh, you didn't RTFA, did you. Nope.

He deliberately, and meticulously planned his crime. He obviously knew they'd fire him at some point. This was premeditated, and every bit as damaging to the company as setting one of their storage buildings on fire.

Re: What's the benefit of throwing him in jail

[Anonymous Coward]

He should have just gone around swinging a bat at people and servers. That is just property damage and assault with a much lower sentence. That'll teach him, being non-violent is a more heinous act!

Re: What's the benefit of throwing him in jail

[ScentCone]

Expensive destruction is expensive destruction. Physical assault on people is another matter. Swinging a bat at people? That's attempted murder.

How is news....

[Anonymous Coward]

It's like 6 months old... http://www.elpasotimes.com/sto...

Re:Ten years? Less time if he'd punched out his bo

[gweihir]

It is. People are still exceptionally stupid and this is one thing they understand even less (it that is possible).

Re: Backups yes. "Everything in VMs", no.

[Anonymous Coward]

Those red attacks can be pretty devastating. Rogue. Rouge is a color.

Not guilty

[Anonymous Coward]

They shouldn't have fired him. This company got what they deserved, though frankly I think it should have been worse.

Please correct the headline.

[BarbaraHudson]

From the official announcement by the Department of Justice, the guy was NOT a sysadmin. He was a help desk monkey.

Appearing before Senior United States District Judge David Briones, Venzor pleaded guilty to one count of transmission of a program to cause damage to a computer. By pleading guilty, Venzor admitted that on September 1, 2016, after being terminated from his position at the company’s help desk, he logged onto the company’s network through an administrator account and shut down the company’s email server and application server while deleting systems files essential to restoring computer operations.

All this "sysadmin gone bad" stuff is one big April Fools joke.

Re:Horrible spelling on Slashdot, again -- not

[BarbaraHudson]

Shhh - we now know that Sarah Palin posts on slashdot - "Going Rouge" :-) If she's busy here, she's not screwing things up elsewhere. Now maybe we can also get Trumputin to stop by?

what an idiot

[Anonymous Coward]

This guy is the kind of stupid that education can't cure. I wonder how old he is?

I resigned from a company and they locked themselves out of several LUKS devices. I volunteered to help them recover from backup, and a few weeks later I was arrested and jailed for supposedly logging in using the CEO's account and deleting their data, denying customers access for months and months. Eventually proved that none of it happened, but I was facing 10+ years without any evidence against me.

They've got this guy for sure.

You're my hero

[Anonymous Coward]

Good job on the backups! I've worked for billion-dollar companies that didn't do backups as well as you. Seriously.

Re:Horrible spelling on Slashdot, again -- not

[Anonymous Coward]

Glad I got at least the one bite! Sad for you.

This happened in the 1960's

[Anonymous Coward]

This somewhat happened in the 1960's to a company I heard about. Two disgruntled employee quit at the same time. They were he only ones who knew how to run the system and how it worked. They both laughed all the way out the door. The company immediately hired a couple of programmers who came in, studied the code, and had the system running smoothly again in a few days. I knew one of the persons who had quit and he was somewhat dismayed at how quickly his deliberate damage was healed.

By the "real world" you mean MS Windows?

[dbIII]

Please note the context of where I used the word pointless. On other systems there are different mechanisms which do indeed make it just pointless overhead to run a VM instead of doing separation in other ways.
The "real world" has systems other than MS Windows in it.

encrypted snapshot backups

Ah - the "real world" bit should have given me a clue - you are a student aren't you? Encrypting your backups in a vastly stupid idea since when the backups are required in the future it can never be certain that someone with the passphrase or whatever is available. Physical security is the answer with backup tapes but beyond that you want them to be as easy to restore as possible. For example, the AMANDA backup system has instructions in ASCII in the tape header of how to get files out on anything that can read the tape (so long as it has "tar" and "dd" you can eventually get everything without needing to install the AMANDA software). Of course it's much easier to use the actual software, but if you don't it's still not hard. That's how you should be doing backups, making them so a PC hooked up to a tape drive is all you need for a relative newbie to get what is needed quickly enough when nobody else is available.

Re:By the "real world" you mean MS Windows?

[geekmux]

Please note the context of where I used the word pointless. On other systems there are different mechanisms which do indeed make it just pointless overhead to run a VM instead of doing separation in other ways. The "real world" has systems other than MS Windows in it.

encrypted snapshot backups

Ah - the "real world" bit should have given me a clue - you are a student aren't you? Encrypting your backups in a vastly stupid idea since when the backups are required in the future it can never be certain that someone with the passphrase or whatever is available...

Clearly you've never worked in a highly regulated environment that is restricted by mandate to encrypt backups when shipping data offsite. And since offsite and offline is the safest place for data in the ransomware-riddled world we live in today, the strategy fits.

Keys are stored in multiple locations to protect against the inevitable unavailability of someone as well. Two is one; One is none. Hope that clears up any ignorant assumptions.

Re:By the "real world" you mean MS Windows?

[dbIII]

Clearly you've never worked in a highly regulated environment that is restricted by mandate to encrypt backups when shipping data offsite

Ah yes, you are very important obviously, at least in your own mind if nowhere else, and are attempting to rub that in but it appears you think the policy of where you are is how it should be done everywhere.
Clearly most people do not because it's as fucking stupid as letting people you do not trust have possession of your backup tapes. If you can't trust who has your tapes then why are you letting them have them?
What about the onsite tapes? What about tapes that have only system files and zero sensitive information? Why encrypt them when it's just another thing to go wrong and nobody who cannot be trusted with them has access to them.

Keys are stored in multiple locations to protect against the inevitable unavailability of someone as well

Over time things get lost (which is why I've had to get stuff from tapes recorded in the 1990s despite the client originally having multiple copies). If someone needs something from a backup or archive in many years time it's very likely that after restructures/buyouts/etc that the key is going to be lost unless it's stored with the tapes (which of course made the encryption pointless in the first place).

Disaster recovery should be simple and adding potential show-stoppers to the process is not a good idea unless the consequences of unencrypted data escaping are far greater than that of losing all of the data on that media forever.

Re:By the "real world" you mean MS Windows?

[geekmux]

Clearly you've never worked in a highly regulated environment that is restricted by mandate to encrypt backups when shipping data offsite

Ah yes, you are very important obviously, at least in your own mind if nowhere else, and are attempting to rub that in but it appears you think the policy of where you are is how it should be done everywhere. Clearly most people do not because it's as fucking stupid as letting people you do not trust have possession of your backup tapes. If you can't trust who has your tapes then why are you letting them have them?

I've used an offsite storage vendor for almost 20 years across multiple companies without a single mishap. The requirement to encrypt is to mitigate risk at all times (including theft or loss), as well as protecting data with any offsite storage vendor. In a nutshell, you encrypt because shit happens.

The only policy I'm recommending here is whatever one fits the business requirement, and has been tested and proven to work. My model isn't necessary for everyone, so go do whatever you want to do to meet the business need for DR/BCP. Complexity is only necessary when justified.

Disaster recovery should be simple and adding potential show-stoppers to the process is not a good idea unless the consequences of unencrypted data escaping are far greater than that of losing all of the data on that media forever.

The consequences are, hence the reason for the encryption mandate, imposed by multiple security standards. I don't do encrypted backups with multiple streams because I have some weird love affair with algorithms. And there are all sorts of ways one can mitigate the complexity risk. Store keys in multiple locations. Store them with 3rd parties to help bolster a two-person integrity model. Test your backups frequently. Multiple copies of backups can be stored both onsite and offsite, each with their own encryption schema. Monitor changes to backup systems. Assign competent SysAdmins to manage.

And quite frankly, if you cannot trust those who manage your security, you've got far larger problems than someone losing encryption keys to backup tapes.

Re:By the "real world" you mean MS Windows?

[dbIII]

My model isn't necessary for everyone

That's the only point I'm trying to make. Above it was suggested as if it was mandatory instead of situations where the consequences of unencrypted data escaping are far greater than that of losing all of the data on that media forever.

The consequences are

For your system backups? No. For other things? Very little information in a typical business is of the sort where it would be a problem if it was published on the front page of a newspaper. That stuff that would be a problem should be treated differently to what is needed for a bare metal restore, which IMHO should be easy enough that a contractor from outside can do it in a hurry without having to wait around for a time window to bother someone for keys. In disaster situations the people who have the keys are probably going to be very busy if they can get on site at all.

Personally I think a policy of treating everything as top secret is a security risk on it's own. You only want to trust a contractor with general information instead of giving them the key to the crown jewels.

Re:By the "real world" you mean MS Windows?

[geekmux]

My model isn't necessary for everyone

That's the only point I'm trying to make. Above it was suggested as if it was mandatory instead of situations where the consequences of unencrypted data escaping are far greater than that of losing all of the data on that media forever.

The consequences are

For your system backups? No. For other things? Very little information in a typical business is of the sort where it would be a problem if it was published on the front page of a newspaper. That stuff that would be a problem should be treated differently to what is needed for a bare metal restore, which IMHO should be easy enough that a contractor from outside can do it in a hurry without having to wait around for a time window to bother someone for keys. In disaster situations the people who have the keys are probably going to be very busy if they can get on site at all. Personally I think a policy of treating everything as top secret is a security risk on it's own. You only want to trust a contractor with general information instead of giving them the key to the crown jewels.

Look, I fully understand and grasp the value of K.I.S.S methodology. Ironically it was a financial audit that initiated the requirement of encrypted media that is sent offsite. Today, I have multiple security standards that mandate encrypted backups on top of the financial requirement. Honestly, I'm struggling to justify your complexity argument here. SSL on web servers increases complexity. Running IDS/IPS, and anti-malware services increases complexity. Complexity is not always a bad thing. Hell, in many ways it justifies needing IT staff, because systems are rather complex, and cannot be built or maintained by just any idiot with a keyboard and mouse.

There is risk inherent with handing unencrypted backup tapes (talk about the "crown jewels") to a 3rd party to be transported offsite, and out of the direct control of an organization. This is why you DO encrypt. Do you add complexity? Sure. Can you mitigate against that with multiple encryption schemas, two-party integrity with key control, onsite and offsite backups, and other measures? Sure.

When evaluating risk, you must also take into account frequency. The risk for activity that happens very frequently (offsite transport) is likely a lot higher than the insider threat of key manipulation or destruction. With key destruction, you risk not being able to run backups or restores. With leaked or stolen data, you may not have any IP to protect anymore. And that's on top of the lawsuits and fines for failing to protect PII, which damn near every company holds, and you will be up shit creek of you inadvertently leak that kind of data.

Re:By the "real world" you mean MS Windows?

[dbIII]

Ironically it was a financial audit that initiated the requirement

With the greatest possible respect, sometimes the quality assurance weenies need to be questioned when they mandate things that are beyond their level of understanding. It is supposed to be a process and not an edict.

talk about the "crown jewels"

Context. Not all data is equal thus "crown jewels" is supposed to indicate the stuff that you do not want anyone to get hold of. Treating everything as if it is the "crown jewels" is IMHO counterproductive because you have two modes of access - everything or nothing. When you need to give an outsider access they should not be able to get to the stuff that is of critical importance unless that is what they are working on.

and you will be up shit creek of you inadvertently leak that kind of data

And I'm in a far worse place if I do something that loses or even endangers the existance of most of the types of data on the premises as are many others.
What you seem to think of as the universal situation of the consequences of a leak being vastly greater than the consequences of loss is the exact opposite in a lot of places. Your "one size fits all" suggestion doesn't fit a lot of places.


Also what's with the lectures? Since they are based on a premise that's not as universal as you seem to think they are someone pointless. If the consequence of a third party stealing those tapes of unencrypted system backups are limited to having to buy more tape it's not really a huge deal. You do not have to encrypt everything and IMHO it's asking for many sorts of trouble if you do.

Re:By the "real world" you mean MS Windows?

[geekmux]

Ironically it was a financial audit that initiated the requirement

With the greatest possible respect, sometimes the quality assurance weenies need to be questioned when they mandate things that are beyond their level of understanding. It is supposed to be a process and not an edict.

I don't make the rules. I do have to ensure we follow mandates to ensure compliance.

talk about the "crown jewels"

Context. Not all data is equal thus "crown jewels" is supposed to indicate the stuff that you do not want anyone to get hold of. Treating everything as if it is the "crown jewels" is IMHO counterproductive because you have two modes of access - everything or nothing. When you need to give an outsider access they should not be able to get to the stuff that is of critical importance unless that is what they are working on.

Remember we're talking about the information that you back up, not how one might segregate and compartmentalize data or access within a network, which is a different conversation. I don't know how others do it, but if I'm spending the resources and effort to perform backups, my tapes aren't exactly filled with pointless shit. They tend to contain the "crown jewels" that an organization cannot afford to lose due to a disaster or compromise. If someone has the IT resources to cherry pick the file server to only back up the valuable data, great. Most don't have that luxury, so you back up the entire file server by default.

and you will be up shit creek of you inadvertently leak that kind of data

And I'm in a far worse place if I do something that loses or even endangers the existance of most of the types of data on the premises as are many others. What you seem to think of as the universal situation of the consequences of a leak being vastly greater than the consequences of loss is the exact opposite in a lot of places. Your "one size fits all" suggestion doesn't fit a lot of places.

I stated before that one should build solutions that fit the business requirement. I didn't run encrypted backups prior to the mandate. I do now because of it. Plain and simple. If you or others don't feel the risk is high enough to warrant the complexity, then do whatever you want. The "one size fits all" argument is really only justified around commonalities such as PII, which as I stated before, almost every business maintains. If your employees suffer identity theft as a result of backup tapes being stolen, and 50% of them choose to work elsewhere as a result, then the impact is considerable. Don't want to run anti-virus because it slows system performance? Fine. Don't want to run a SPAM filter because it costs too much? Fine. Businesses that are not encumbered by mandates are able to mitigate risk however they want to.

Also what's with the lectures? Since they are based on a premise that's not as universal as you seem to think they are someone pointless. If the consequence of a third party stealing those tapes of unencrypted system backups are limited to having to buy more tape it's not really a huge deal. You do not have to encrypt everything and IMHO it's asking for many sorts of trouble if you do.

If someone steals a backup tape, corporate smartphone, or a laptop, the last thing I'm worried about is the cost of replacing the asset itself. Data loss is far more of a priority. If a company values their information at no more than $100 worth of backup tapes, I would question why they're even bothering running backups.

Re:By the "real world" you mean MS Windows?

[dbIII]

I don't make the rules

Then why push it as mandatory on others?
It's nothing but an extra point of failure for those situations where the data is not sensitive enough that publication would matter.

Re:Hitting his boss would do less damage (seriousl

[dbIII]

For example, imagine I went into a hospital's case management system and put a trigger on the database to double all new doses on insert. It's a "simple" attack but could have very deadly consequences.

Unlikely. Nurses check paperwork, which gets printed onto actual paper and they would see the previous dose. That's a system that is already has a lot of mistakes from data entry so has error checking outside of the computer system.

You do have a point, just the example doesn't quite fit.

And this, ladies and gals

[Anonymous Coward]

Is why you should not fuck over people who detain the keys of the kingdom like baristas or MacDonalds employees.

Re:Backups yes. "Everything in VMs", no.

[Anonymous Coward]

Wait, "VMWare"?

Let's go back to "laughable".

VMWare markets well, but VMWare centrism leads you to some odd places⦠like thinking that only VMWare can do virtualization, or that all important things must be virtualized⦠(we're going to virtualize your hypervisors, bro!)

In the real world I'm accustomed to, you gather requirements, including SLAs, and then work on several different approaches and arrive at a selection of basic solutions on which you assess impact, risk, cost, stability, resiliency, operational effectiveness, and devise a list of pros and cons to present to the business.

The SLAs and limitations on approaches will vary with regulations, company culture and competency, and your own creativity.

Agreed that a DR solution can be used for recovery of this kind of thing⦠but more concerning is that an outside contractor had to come in to fix it. WTF? Were they firing their core administrative expertise?

I suspect a deeply fucked-up company culture. Especially since they didn't have a way to boot from clean media and un-fuck their systems, but they apparently quickly found the "forensic trail" that lead to the departing admin.

Although it was unbelievably stupid I can't help

[Anonymous Coward]

but feel sorry for the idiot. When the guys inmate number and location are found out I'd be happy to send him some money for his canteen.

Look up "similar" in the dictionary

[dbIII]

Ah - semantics now. Dropping every packet at every point of ingress and egress is effectively the same as an air gap, and is the same if you do it by unplugging things.
What's with the bluster, getting personal and the need to show dominance? It's kind of pathetic the way you are big noting yourself to try to show how much better you are than someone who offered a suggestion.

You don't because shit happens - you lose data

[dbIII]

you encrypt because shit happens

If the consequence of data loss is very high you DON'T encrypt because the vastly increases the chance of loss - when shit happens your careful house of cards with the keys doesn't even have a table to sit on and is lost. A corporate restructure, let alone a buyout, is likely to lose those keys and anyone who knows where they are.
As I wrote elsewhere, I've had to have reels of tape transcribed (on well over a dozen occasions now) because the client lost their copies over time and the tape that was sent to my workplace years ago to transport the data to the people interpreting it ended up being the only one surviving. If someone in the 1980s decided to encrypt those tapes the key would be long gone with most of the other paperwork so it would mean a very expensive seismic survey to get that data again. All industries have similar situations where old information is of great value but not any sort of secret.

Accounts info - sure you don't want all that getting out, but in the general case? That is asking for trouble.

Kind of pathetic

[dbIII]

So you've marked me foe because I didn't act meek and mild after you jumped in on me stating the obvious and said I was someone you would fire? That's somewhat pathetic.

Re:Kind of pathetic

[arth1]

No, because you're wasting my time with your ignorance.

Re:Kind of pathetic

[dbIII]

It looks very much like you are very good at dishing out something truly vicious ("I'd fire you") while not being able to put up with some relatively mild questions of your words and no attack at all upon your person.
Truly pathetic.