Can't tell if this is sarcasm, but corporations are not people, they are soulless, for-profit enterprises that will, for damn sure, abuse and exploit any one and any thing they can in the name of profit. They don't get the defense of "victim blaming".
If they open themselves up to malicious actors through improper security, or lawsuits due to improper practices, then that's their own fault.
It's their own fault if they didn't take the reasonable precautions that anyone should be aware of when going in to business for profit.
Notice how in my original comment I added "through improper security" and "improper practices".
If you are running a business and get robbed without security cameras, insurance, and other reasonable protective and preventative methods, then you are at fault.
Ehhh I dunno. Saying it's the stores fault they got robbed feels wrong. It's the robbers fault for, you know, robbing. I mean, how far does that go? They had locks but not good enough locks. Yeah they had locks but no security system. Well they had a security system but no guard. At some point the blame is on the person that actually committed the crime.
My point is that corporations cannot be victims because they're not people, they're a legal construct. They cannot be victims any more than a table can be a victim when I spill my drink over it. The term "victim", whether intentional or not, is an emotive word that invokes ideas of injustice and suffering.
Marketing teams and corporate executives convinced people and legal systems that corporations are people in an attempt to engender sympathy, personification, and to avoid responsibility for their own failures, like the case in this article where managerial and procedural failures by those in charge led to the ability for this ex-employee to be able to do what he did.
Murder is wrong and all but I'm perfectly fine with someone shooting someone as bad as Hitler. Corporations do financial and environmental crime on a daily basis, someone causing financial loss for them provokes no sympathy from me.
I really don't have a dog in this fight, but I do want to point out that we're talking about an IT company (an apparently incompetent one) here, not some company that drills for oil in the Amazon.
NCS is a company that offers information communication and technology services.
Wait…
he used his laptop to gain unauthorised access to the system using the administrator login credentials.
Okay, what the guy did was immature and shitty, but holy hell this company is incompetent. How did their own internal IT not lock him out of anything even remotely sensitive the moment he was fired?
Probably HR (or the NCS equivalent) never told the right people. I am not saying this is actually what happened, but a lot of IT bemoan the fact they are never told some rando employee was fired because HR neglects to inform them. Sometimes it takes months to discover, and even with a 90 day password/login lockout, some halfway decent admin could get around this by secretly building a back door, and using the messed up communication and politics between departments to hide this. Even in the 1990s, I saw people put in "time bombs" in their code that "if such and such is not updated in 6 months, run destructo-script A."
But imagine someone like Kandula Nagaraju here. Worked in QA, probably did a great jobs with some skills, but had the personality of swallowing broken glass. He was terminated in October 2022 due to "poor work performance," which could mean anything. "Not a team player." Or maybe he really was an idiot: I mean, a smart person would have a conniption, but get employed elsewhere and then slam his former company at parties. "Those NCS folks didn't know what they had with me!" But this guy was probably someone with some anger management issues, probably a jerk, and possibly stupid. He might have had revenge fantasies, and set up a small virtual server posing as a backup code mirror. But outside the audits, it allowed ssh from the outside, and hid it through a knockd daemon. Or maybe only launched ssh at certain hours before shutting it down again. Silently working away in a sea of virtual servers with little to no updated documentation. He gets in, has internal access, and runs a script with admin credentials because they don't rotate their AWS keys/secrets quickly enough. Or didn't even know he was let go.
After Kandula's contract was terminated and he arrived back in India, he used his laptop to gain unauthorised access to the system using the administrator login credentials. He did so on six occasions between Jan 6 and Jan 17, 2023.
That's embarrassing to the company. Not only did he get in, but SIX TIMES after he was let go. he probably knew what order to run the delete commands (like, say, an aws "terminate-instances" cli command from a primary node), and did so one by one, probably during hours with the least amount of supervision, where the first few alerts would take hours to get someone in the monitoring chain to wake an admin. Given his last day was in November, and he got back in January, the admins probably thought their 90 access credential rotation was "good enough," but he got in on his 80th day or whatever.
I know this because I have had to do triage when a former contractor did this to a company I worked for. But instead of wiping out instances, he opened a new set of cloud accounts from the master account, put them in an unmonitored region (in this case, Asia), and spun up thousands of instances to run bitcoin mining. Only because AWS notified us of "unusual traffic" were we made aware at all, and this guy knew his shit and covered his tracks very well. He did it at a speed that could have only been automated. Thankfully, AWS did not charge us the seven figure amount that this activity amassed in just three days.
I've had people above me fired in a startup and I was asked by the board of the company to lock their accounts and seize their professional laptops while they were in a meeting informing them they were fired.
The idiots had tried to stage a "coup" against the CEO which failed spectacularly.
I've been in IT for a few years and I've changed companies a few times.
I just checked my login creds for various systems of 3 previous employers and like half of them still work.
Unfortunately it's a lot more common than any IT department would like to admit
Generally a firing is decided the previous day or at least an hour before it happens. Discussions are made prior to the actual meeting where the firing occurs. IT is on standby. They either deactivate the AD account and related auth methods when the employee walks in the office to have the discussion. This is a well oiled machine, so that all parties know their parts. The meeting/discussion is solely a formality and by two minutes into it, theres no longer any access granted. Security shows up at the meeting to escort the employee out and collect their badge or keys. Maybe they let the employee walk by their desk to collect their stuff, maybe the employer ships it to them later, depends on the circumstances and office layout.
