36.3. Conclusion

Firing SAs isn’t fun or easy, but sometimes it has to happen. The basics are very simple. The most important rule is to follow the policies of your HR department. HR personnel are the experts, and you are supporting their process. Three tiers of access must be removed: physical access, remote access, and service access. The primary benefit of the three-tier model is that it provides a structured, rather than ad hoc, approach and is tolerant of mistakes made at any one level. Architectures that seek to minimize the number of access databases and a well-maintained inventory ease the process considerably.

In creating a checklist for all the manners of access to be disabled, one might begin with the new-hire procedure as a starting point: Whatever is done for a new hire must be undone for a termination. Although no checklist is complete, we have assembled several checklists of things to disable in the event of termination: