## Chapter 18 — Disabling an account does not sanitize a disk ### Lesson map Lesson 18. Map, example, EX064. ```mermaid flowchart TD L["A leaver"] --> A["Disable the account the same day"] L --> R["The laptop is returned, when it is returned"] A --> N["Authentication stops"] R --> P["Custody of the hardware changes"] N --> X{"Did disable wipe the disk?"} P --> X X -->|No| K["Encryption remains its own control"] ``` Account state, physical custody, and media sanitization are three actions. ### Logical drawing ```text leaver account disabled the same day laptop returned row noted in the spreadsheet no name and no date printed joiner standard account, MFA in person, two-minute saving talk not the admin account cupboard machine wiped and recycled not the leaver procedure missed leaver the monthly account comparison can catch one within a month no missed leaver is actually named ``` ### Learning outcomes After this chapter, you should be able to: 1. Separate disabling an account from wiping a disk and from taking a laptop back. 2. Keep joiners off the administrator account. 3. Leave every leaver unnamed, and leave the cupboard disposal on its own record. ### 18.1 Authentication, custody, and sanitization fail independently. SP 800-53 Rev. 5 puts these in different families, and the case shows why the split is real. AC-2 names account management. When a volunteer leaves, Leah disables the account the same day and notes the person against the laptop in the spreadsheet. Disabling an account means that credential no longer authenticates. It does not change the encrypted bit, and it does not destroy the bytes on the disk. MP-6 names media sanitization. The cupboard laptop was wiped and recycled, with a record. That was an unused machine found during the inventory, not a leaver. Using the cupboard story as if it were the leaver procedure merges two events. The book never says a returned leaver laptop is wiped. It says the laptop is returned and the account is disabled. Physical return is a third event. A laptop that is never returned is, in the book's words, encrypted and has no working account behind it. Volume unreadability comes from encryption, whereas mailbox access ends because that credential is disabled. No remote-wipe product is named for a laptop that never came back. A joiner is the opposite edge. A new volunteer receives a standard account, MFA set up in person, and a two-minute talk on saving files to the cloud. The joiner does not receive the separate administrator account. That account stays with Leah and the deputy manager. The monthly routine compares active accounts with current volunteers, so a missed leaver is caught within a month. "Within a month" is the bound on the check. It is not a count of missed leavers, because no missed leaver is named. No leaver's name, last day, or forwarding address is printed. NIST SP 800-61, already cited in chapter 4, describes incident handling in much more detail than these joiner and leaver steps. The food bank's leaver action is account disablement plus return of the device. It is not a recorded incident ticket, and the stolen laptop from last month still has no ticket number in this file. Do not invent one. ### 18.2 Worked example | Event | Action the book records | Action it does not record | |---|---|---| | Leaver | Disable the same day; laptop returned; spreadsheet note | A name, a date, a wipe | | Unreturned laptop | Encrypted, and no working account | A remote-wipe product | | Joiner | Standard account, MFA in person, saving talk | The admin account | | Cupboard laptop | Wiped, recycled, recorded | Being a leaver | > **Synthetic case.** No volunteer is given a departure date. ### Errors and limits A same-day disable stops authentication. Bytes on a disk that left the building are a media problem, and this procedure does not claim to have solved it by disablement alone. ### Apply - **EX064 — Three actions?** A leaver's account is disabled the same day. A classmate says that disablement wiped the disk, names the leaver, and treats the cupboard recycle as that same event. What do you correct? *Rubric:* 3 = disablement stays an account action; return stays custody; the cupboard wipe stays a separate disposal; no leaver name, date, ticket, or remote-wipe product is added; a joiner still does not receive admin;; 2 = the three actions stay distinct;; 1 = one action;; 0 = none. ### Continue studying — lesson 18 (chapter 18 of 20) [← Chapter 17](#ch-17) · [Course chapter index](../SUBJECTS.md) · [Chapter 19 →](#ch-19) Continue to the next authored lesson. ## Worked answers **EX064.** Disablement stays an account action. Return stays custody. The cupboard wipe stays a separate disposal. No leaver name, date, ticket or remote-wipe product is added. A joiner does not receive the admin account.