While we fire the boss, can you lock him out of the network?

A consultant recounts an insider-risk incident where a company’s chief network engineer allegedly accessed HR files, secretly hosted a hot backup site at home via VPN, and was later terminated; due to an oversight leaving his name on the ISP authorization list, the ex-employee throttled the company’s bandwidth, causing prolonged slowness until discovered. The episode underscores the importance of revoking all third-party authorizations and controlling shadow infrastructure to mitigate insider threats and operational risk.