Helpful first: Law, due care, and ethics
Thirty days to Halcyon · Case 9: The new control room · Episode 3 of 12
Five of the six Kestrel background checks are back. The sixth is not. Its owner, a flight dynamics engineer, starts in Halcyon's new control room on Monday.
Kael Cho, Staff Infrastructure Engineer, has an idea. "Give them a read-only account for now. What can read-only hurt?"
Sloane Sterling, Head of Compliance, does not look up from her checklist. "Ask our analyst." They both turn to you.
By the end you can
- Match each personnel control to its stage, from screening to termination
- Explain what job rotation and mandatory vacations are meant to detect
- Order the steps of a high-risk termination so access is revoked first
Why people need controls too
The new control room will have locked doors, encrypted links, and signed commands. A trusted insider can bypass all of them if personnel security is neglected.
Personnel security is the set of controls that apply to people. The controls follow a person through four stages, from the day they apply to the day they leave. Each stage has its own job.
The sixth Kestrel engineer is still at the first stage. Kael's read-only account belongs to the second. So his idea is not a small shortcut. It skips a stage.
- Before hiringScreen the candidate
- OnboardingSign, then get access
- EmploymentRotate duties, require vacations
- TerminationRevoke access, recover hardware
| Stage | Controls | What they are for |
|---|---|---|
| Before hiring | Background check, reference verification, credential validation | Know who you are trusting before you trust them. |
| Onboarding | Signed acceptable use policy and non-disclosure agreement, then least-privilege credentials | Set the rules in writing before access exists. |
| Employment | Job rotation and mandatory vacations | Detect and deter fraud or collusion. |
| Termination | Access revocation, hardware recovery, exit interview | Close every door the person could still use. |
Before the first login
Before hiring, an organization checks who it is hiring. It runs a background check, verifies references, and validates credentials. The depth of the check is proportional to the sensitivity of the role. It also has to follow local employment law.
A seat in Halcyon's control room is a sensitive role. Until the check comes back, Meridian does not know who it is trusting with that seat.
Onboarding comes next, and its order is fixed. The new person signs the acceptable use policy (AUP) and the non-disclosure agreement (NDA). Only then do they receive credentials. Those credentials follow least privilege. That means the person gets only the access the job needs.
Kael's read-only account fails twice. It arrives before the check and before the signatures. Read-only also still shows the telemetry.
PUT IT IN ORDER
A seventh Kestrel engineer has just been proposed for the room. Put the steps in the order Meridian must follow.
- Run the background check and verify references and credentials
- Decide how deep the check must be for a control room seat
- Issue credentials with only the access the job needs
- Have the engineer sign the AUP and the NDA
Show the answer
- Decide how deep the check must be for a control room seat
- Run the background check and verify references and credentials
- Have the engineer sign the AUP and the NDA
- Issue credentials with only the access the job needs
The role sets the depth of the check. The check comes before any commitment. Signatures come before credentials, and credentials are least privilege from the start.
YOUR CALL
Monday, 08:30
The engineer is in the lobby with a visitor sticker and a lunch box. The background check is still not back.
Kael asks what to do with them today.
Thursday. The check is back and clean. Kael has the account ready and his cursor on the enable button.
Strong calls keep the stages in order. No access before the check, and no credentials before the signatures.
Show the strong calls
- Guest badge, an escort, and no account. Start with procedures and paperwork. They spend the day in a meeting room reading runbooks. It is dull, and there is nothing to undo later.
- Signatures first. AUP and NDA, then enable. It takes ten minutes. The account goes live with the rules already agreed in writing.
While they work: rotation and time away
A person who passes every check can still go wrong later. Two administrative controls detect and deter fraud and collusion during employment.
Job rotation moves engineers across operational duties. No single person keeps sole hold of a critical workflow.
A mandatory vacation takes a person away from the work for a block of one to two weeks. Their privileges are suspended for that time. A replacement operator runs the work. The replacement can audit and observe the environment for hidden backdoors and unauthorized manual workarounds.
Neither control accuses anyone. Both apply to every operator in the control room, including the ones everybody likes.
SORT IT OUT
Sloane's checklist has come apart in the printer. Put each control back under the stage where it belongs.
Show the answers
- Before hiring. Screening happens before the person joins, so the result can change the decision.
- Onboarding. The signature comes at onboarding, before any credentials are issued.
- Employment. A mandatory vacation is a control for people already trusted with the work.
- Employment. Job rotation stops one person from holding a critical workflow alone.
- Termination. Physical access is revoked along with logical access when the person leaves.
Leaving: the order matters
At termination, sequence matters. There are two cases.
The first is a voluntary resignation. HR and security disable access on the final day. They recover the hardware. They remind the person that the NDA still binds them after they leave.
The second is an involuntary or high-risk termination. Here access goes first. Kael revokes active sessions, directory accounts, SSH keys, and physical badges immediately before HR notifies the person. At the latest, he does it at that exact moment. The exit interview comes afterwards.
The reason is the gap in between. A person who has just been told, and whose credentials still work, has a window to destroy data or copy it.
Voluntary resignation
- Access disabled on the final day
- Hardware recovered
- Reminder that the NDA survives
Involuntary or high-risk
- Sessions, accounts, keys, and badges revoked first
- HR notifies at the same moment or just after
- Exit interview and hardware return follow
SPOT THE PROBLEM
A Kestrel contractor on the propulsion team is being let go for cause at 14:00. This is the plan Kael was handed. Flag the lines that are in the wrong place.
Show the answers
- 15:00 Cleanroom badge deactivated Physical access must go with logical access at 14:00. For an hour this badge still opens the cleanroom.
- 17:00 SSH keys removed at end of day Three hours with working keys is the window you are trying to close. Keys go at 14:00 with everything else.
CHECK YOUR JUDGMENT
A senior propulsion engineer at Meridian will be terminated at 14:00 UTC. An internal investigation found unauthorized copying of trade-secret telemetry models. Sloane asks what the security team should do first to protect Meridian.
CASE FILE · CASE 9 · ENTRY 3 OF 12
Answer the closing question correctly to add this entry to your case file.
Check, sign, then access
No Kestrel engineer gets a control room account until the background check is back and the AUP and NDA are signed.
Next episode: Priya has read the room's budget. She wants to know what it is worth protecting, in dollars.
Review sheet: exam notes and quick reference
NEXT EPISODE