Shionogi, a Japanese pharmaceutical company, was recently hacked by a former disgruntled IT administrator as reported by Fahmida Y. Rashid in the Latest Anonymous Havoc, Resurgent Spam Lead Week's Security News from eWeek.com.  The former employee hacked the system via free WiFi in a local McDonald’s after having been laid off by Shionogi.

“During his intrusion, he deleted the company's virtual infrastructure, equivalent to 88 physical servers, and brought the company to a standstill as it tried to recover data,” this alone shows proper procedures were not in place with the termination of employment, especially under the circumstances that the employee had access to sensitive passwords to the server infrastructure.  In addition to best practices in account identity management there should have been another layer of security protection of a least privileged approach and segregation of duties.

This case points out how important it is to ensure that IT administrator have permissions to only what is necessary for their specific job role.  For instance, administrators who are responsible for daily operations such as patch management may automatically be granted full administrative rights or often times, administrators who are responsible for managing applications can also request full administrative rights to the entire server in order to support applications.   In reality, administrator rights can be elevated to perform only the necessary functions, such as approved software installations, disk management, or to manage specific applications.  In some scenarios, IT may want to restrict administrators functions, such as removing/reducing the ability to modify members of the local admin group, install server roles, etc.  This segregation of duties for administrators can be achieved by implementing granular privilege management policies and following best practices related to separation of duties.  Following basic best practices, such as having the proper procedures in place after the termination of an employee (including those steps for “privileged” users), operating in a least privilege environment, and establishing separation of duties policies can ensure your organization is less vulnerable to internal and external attacks.