Disabling an account does not sanitize a disk

Lesson map

Lesson 18. Map, example, EX064.

flowchart TD
  L["A leaver"] --> A["Disable the account the same day"]
  L --> R["The laptop is returned, when it is returned"]
  A --> N["Authentication stops"]
  R --> P["Custody of the hardware changes"]
  N --> X{"Did disable wipe the disk?"}
  P --> X
  X -->|No| K["Encryption remains its own control"]

Account state, physical custody, and media sanitization are three actions.

Logical drawing

leaver
    account disabled the same day
    laptop returned
    row noted in the spreadsheet
    no name and no date printed
joiner
    standard account, MFA in person, two-minute saving talk
    not the admin account
cupboard machine
    wiped and recycled
    not the leaver procedure
missed leaver
    the monthly account comparison can catch one within a month
    no missed leaver is actually named

Learning outcomes

After this chapter, you should be able to:

1. Separate disabling an account from wiping a disk and from taking a laptop back.
2. Keep joiners off the administrator account.
3. Leave every leaver unnamed, and leave the cupboard disposal on its own record.

18.1 Authentication, custody, and sanitization fail independently.

SP 800-53 Rev. 5 puts these in different families, and the case shows why the split is real. AC-2 names account management. When a volunteer leaves, Leah disables the account the same day and notes the person against the laptop in the spreadsheet. Disabling an account means that credential no longer authenticates. It does not change the encrypted bit, and it does not destroy the bytes on the disk. MP-6 names media sanitization. The cupboard laptop was wiped and recycled, with a record. That was an unused machine found during the inventory, not a leaver. Using the cupboard story as if it were the leaver procedure merges two events. The book never says a returned leaver laptop is wiped. It says the laptop is returned and the account is disabled.

Physical return is a third event. A laptop that is never returned is, in the book's words, encrypted and has no working account behind it. Volume unreadability comes from encryption, whereas mailbox access ends because that credential is disabled. No remote-wipe product is named for a laptop that never came back. A joiner is the opposite edge. A new volunteer receives a standard account, MFA set up in person, and a two-minute talk on saving files to the cloud. The joiner does not receive the separate administrator account. That account stays with Leah and the deputy manager.

The monthly routine compares active accounts with current volunteers, so a missed leaver is caught within a month. "Within a month" is the bound on the check. It is not a count of missed leavers, because no missed leaver is named. No leaver's name, last day, or forwarding address is printed. NIST SP 800-61, already cited in chapter 4, describes incident handling in much more detail than these joiner and leaver steps. The food bank's leaver action is account disablement plus return of the device. It is not a recorded incident ticket, and the stolen laptop from last month still has no ticket number in this file. Do not invent one.

18.2 Worked example

Lesson table; scroll horizontally to read all columns →

Synthetic case. No volunteer is given a departure date.

Errors and limits

A same-day disable stops authentication. Bytes on a disk that left the building are a media problem, and this procedure does not claim to have solved it by disablement alone.

Apply

• EX064 — Three actions? A leaver's account is disabled the same day. A classmate says that disablement wiped the disk, names the leaver, and treats the cupboard recycle as that same event. What do you correct?
  Show marking criteria

  Rubric: 3 = disablement stays an account action; return stays custody; the cupboard wipe stays a separate disposal; no leaver name, date, ticket, or remote-wipe product is added; a joiner still does not receive admin;; 2 = the three actions stay distinct;; 1 = one action;; 0 = none.