Forgotten But Not Gone: The Ex-Employee Risk
Failure to deprovision former employees presents a real risk to businesses.
An article review.
When terminating an employee you probably make sure that they turn in keys, access cards, and any other physical access credentials, but how sure are you that their electronic credentials have been revoked? A new study being highlighted by CIO Insight suggests in many cases that may not be happening–and it’s leading to breaches.
The survey, conducted by security firm OneLogin, found nearly half of respondents were aware of issues with the timely revocation of ex-employee credentials, while twenty percent of respondents said they believed such a failure led directly to a data breach at their organization.
The authors of the survey go on to suggest that account deprovisioning should be handled on an automatic basis to help prevent the kind of oversights that can lead to credentials remaining valid, though this relies on termination notifications being relayed to the appropriate department in a regular, rapid fashion–another task that may not be accomplished all the time, especially during periods of system upgrades and downtime when IT Departments may be overwhelmed.
Given the often serious impact of a data breach, both monetarily and in reputation, the study concludes that organizations should always ensure the basic task of account deprovisioning be carried out as soon as possible after an employee termination.
Original article by Karen Frenkel writing for CIO Insight.
