CertiGuide to Security+  9  Chapter 5:  Operational/Organizational Security (Domain 5.0; 15%)       9  5.4  Policy and Procedures            9  5.4.1  Security Policy                 9  5.4.1.9  HR (Human Resources) Policy

5.4.1.9.1  Termination 1 5.4.1.9.3  Code of Ethics

It is the duty of the IT department to work with HR to add/revoke passwords, privileges, etc. for both temporary and permanent staff. This is not being handled properly according to NetworkWorld⁴⁴⁰. For example, just as it is not at all uncommon to browse through a company’s user account list and see accounts tied to users who have not been associated with the organization for several years, it is not uncommon to see more than a handful of users with administrative privileges – many of whom do not work as network administrators.

When adding accounts, it is too easy to just give an employee access to everything he or she might possibly ever need, rather than paying attention to what his or her job duties are, and assigning privileges accordingly, as required by the principle of least privilege.

5.4.1.9.1  Termination 1 5.4.1.9.3  Code of Ethics