My IT Manager is leaving, and I'm concerned about the security of our web app hosted on DigitalOcean. He mentioned that if I remove his SSH key from the account, he won't have access anymore. However, since he developed most of the code on his own laptop, I'm worried that he could still have a copy or some form of access. What can I do to secure our system and confirm he can't access it anymore?
4 Answers
First off, make sure you’re the new point of contact for the DigitalOcean account. Confirm that any important code is backed up and stored in a repository that you control, like GitHub or GitLab. If the code is only on his laptop, that’s a big red flag. You need to establish ownership of the code and ensure it’s in a secure place before he leaves. Also, remember to remove his SSH key immediately after he’s gone to cut off any remote access.
Honestly, if you’re having these concerns, it may mean you need to gather more expertise on security. If you can, bring in someone with experience to help you during this transition. And remember, getting the code into a secure, centralized location is key before he leaves.
Cycling the keys is definitely a solid first step. After you remove his SSH access, double-check all the security settings of your DigitalOcean account. It's crucial to limit remote access to only necessary ports and IPs. Also, think about using a VPN for accessing the server moving forward. Keeping your architecture secure is key.
Just a heads up, even after you remove his access, you can’t be 100% sure he’s completely locked out. Ensure there are no back doors or hidden scripts in your web app. It might be worth conducting a security audit or having a professional take a look once he’s gone. Don't underestimate potential loopholes.
Exactly! If he had root access, there might be vulnerabilities that can be exploited. It’s better to be safe and thorough.
Absolutely! Make sure you get all the existing code into a version control system as soon as possible. Consider hiring a new IT person who can help manage the transition and security.