SoylentNews is people
SoylentNews
from the credentials-still-worked-FIVE-MONTHS-after-he-left? dept.
Sudhish Kasaba Ramesh, who worked at Cisco from July 2016 to April 2018, admitted in a plea agreement with prosecutors that he had deliberately connected to Cisco's AWS-hosted systems without authorization in September 2018 – five months after leaving the manufacturer. He then proceeded to delete virtual machines powering Cisco's WebEx video-conferencing service.
"During his unauthorized access, Ramesh admitted that he deployed a code from his Google Cloud Project account that resulted in the deletion of 456 virtual machines for Cisco's WebEx Teams application, which provided video meetings, video messaging, file sharing, and other collaboration tools," the US Attorney's Office for the Northern District of California said in a statement.
According to prosecutors, Ramesh's actions resulted in the shutdown of more than 16,000 WebEx Teams accounts for up to two weeks, which cost Cisco roughly $1.4m in employee time for remediation and over $1m in customer refunds.
[...] According to a court document[*], Ramesh is in the US on an H-1B visa and has a green card application pending.
[...] Ramesh faces up to five years in the clink and a fine of $250,000 when he is sentenced, an event scheduled for December.
[*] STIPULATION AND (PROPOSED) ORDER CONTINUING DATE FOR ENTRY OF PLEA AGREEMENT (PDF)
(Score: 2) by Booga1 on Monday August 31 2020, @06:52AM (2 children)
No kidding. As a sysadmin I've had all access revoked as soon as I locked my machine and stepped away from my desk on the last day. It shouldn't be some giant task to do that. It should be as simple as disabling or deleting an account.
At the VERY worst there might be service accounts he had access to, but even with that they're supposed to be rotating passwords regularly. Why, oh why did he have any access at all for MONTHS after he left? He's to blame for his actions, but they should never have been possible in the first place.
(Score: 1, Touché) by Anonymous Coward on Monday August 31 2020, @07:31AM
Indeed. We have two mishaps, one a firm who did not revoke credentials. Two an engineer who used said credentials instead of losing them to "some hack"😁.
(Score: 2) by Grishnakh on Monday August 31 2020, @03:21PM
This is basically like a bank that gets robbed by their former employee because they left the doors unlocked or didn't bother to change a safe combination after he left, and then tries to blame the ex-employee. What kind of idiot would trust their money to that bank?