Getty Images
Residual access failures put data at risk
Stop breaches that start with orphaned accounts. This guide identifies offboarding weak spots and gives leaders a practical checklist to close gaps fast and prove compliance.
Layoffs, resignations, retirements and terminations are all part of doing business. But the data complexities associated with employees and contractors moving on don't have to be.
When someone leaves an organization -- for whatever reason -- the problem isn't the departure. Instead, it's the system access employees still have after they're long gone. Residual access to the network, the domain, applications and third-party websites remains a common yet preventable cause of data exposure that often stems from credential misuse and slow deprovisioning.
Residual access isn't just an IT issue, though it's often treated as one. It sits at the intersection of security, HR, legal, compliance and leadership, with each party accountable for specific actions. Even though most organizations have an offboarding checklist to reduce this type of data exposure, there are still oversights -- such as a lack of communication -- that leave systems exposed and easy to exploit. This creates unnecessary risk that can have lasting effects not only on the business but the careers of those involved.
The risks leaders miss
Organizations don't have to suffer a massive data breach to have a problem. Employee access to systems, data or facilities when no longer warranted creates regulatory, contractual and legal consequences. Residual access puts the following data at risk:
- Personally identifiable information for customers and employees.
- Financial records and forecasts.
- Intellectual property.
- Legal and HR files.
- Critical internal and external login credentials.
In these scenarios, tracing the cause of the breach can be hard. Even if the organization identifies the culprit, it can still face regulatory violations, failed audits and legal exposure if data is misused. The company also risks reputational damage, which costs more than prevention does.
Intent rarely matters. Regulators, attorneys, judges, juries and customers won't care if a breach by an ex-employee was malicious or an honest mistake. What matters is whether the company maintained reasonable access control, or if it was merely glossed over and forgotten.
There are two failure points where access control often breaks down. Treat the fixes as a process to minimize harm to the business.
Failure #1: Incomplete asset recovery
Company-issued devices are more than physical equipment. They are gateways to access the network and local data. Laptops, phones, tablets, USB drives and even personal devices under BYOD policies routinely store or cache the following sensitive information:
- Email and document archives.
- VPN credentials and certificates.
- Passwords and password-manager data.
- Cloud session tokens.
- Internal documents with sensitive customer or business information.
Too many organizations have a return policy but no verification process. It's dangerous to assume that devices are returned, wiped and secure. However, an organization cannot take a one-size-fits-all approach to returning devices. They must know what's on any given device. To do so, they must perform not only a hardware inventory, but also an inventory of sensitive records on the device.
Organizations can't fix what they don't inventory. It's akin to not having goals yet moving forward toward an objective. How will they even know what to look for or how they're getting there?
There are several procedures and technologies organizations can put in place to minimize risk.
- Asset recovery procedures tied directly to employee offboarding within HR and legal workflows. Assign ownership and clear due dates.
- Hardware asset and data inventorying, both internal and in the cloud.
- Remote locking and wiping executed at the time of separation and not a minute after.
- Technical confirmation of data removal or encryption. Confirm the data is inaccessible, not just that the device was returned.
Organizations must also focus on physical access. So much of IT and security focuses on the internal network and the cloud, treating physical access as less important. That's a mistake. If physical access to company premises isn't terminated immediately, the door is left wide open -- literally. Collect entrance badges, key fobs and other means of building access upon departure. Physical access lets bad actors steal documents, install rogue devices and Wi-Fi access points, and gain unauthorized entry to restricted areas.
Failure #2: Orphaned accounts across systems
In many businesses, orphaned accounts are forgotten until it's too late. This failure is where problems fester over time and become nearly impossible to resolve.
Former employees don't need amazing hacking skills. They had access to numerous systems during their employment and might retain it after departure. Vulnerable systems include the following:
- Identity platforms and services based on job roles, some specific to individual employees.
- VPNs and remote access.
- Email, including shared mailboxes and calendars.
- File shares and cloud storage.
- Collaboration platforms such as Teams, Slack and Meet.
- CRM, HR and finance systems.
- Third-party vendor and partner portals.
With all this access, it's not uncommon to find orphaned accounts due to role changes and temporary permissions that were never revoked.
Former employees know how to retrieve information because many of them either worked on these systems daily or designed them and know everything about them -- the good, the bad and the backdoors. Shadow IT -- and now shadow AI -- adds further complexity for account exposures.
External platforms are some of the biggest visibility gaps. Third-party vendor and partner portals are especially vulnerable yet often forgotten about. In-house or external SaaS tools, cloud consoles and analytics systems can stay active indefinitely. Cloud services in AWS, Google Cloud Platform and Microsoft Azure might not give alerts by default on risky changes. Without a proper logging and monitoring setup, problems can remain unnoticed until something breaks or gets breached.
Where organizations go wrong
Poor access oversight weakens security and undermines stakeholders' ability to defend their positions when something goes wrong. Organizations primarily struggle with one key issue: fragmentation. It shows up in two ways.
The first is unclear ownerships. Offboarding has too many pieces to ensure a smooth process. For example, HR handles the separation process. IT disables accounts and receives returned hardware. Security is expected to oversee it all and pick up the slack, while legal only gets involved after it's too late.
The second issue is scattered record-keeping. IT and security professionals don't always know where information is, what's happening on the network or someone's employment status. They have a separate set of responsibilities while HR handles hiring and firing. Bystander apathy, where everyone expects someone else to take care of things, creates the perfect storm for disaster.
Both digital and physical access management require a single, consistently enforced process starting during onboarding and ending with strong offboarding procedures. Anything less creates gaps, delays and ambiguity, which facilitates risk. Auditors and compliance frameworks increasingly expect organizations to prove prompt and complete access removal.
How to avoid residual access
Organizations simultaneously overcomplicate and oversimplify employee offboarding and get burned. The solution isn't buying the latest platform or hiring someone to build out a new framework. Instead, the work is internal. It's about getting the basics right and having accountability.
The following are steps organizations can take to ensure they have a solid foundation for protecting data from residual access risks.
- Have a security oversight committee.
- Build identity lifecycle management tied directly to HR systems.
- Make sure departures, especially those that are involuntary, trigger immediate access revocation.
- Gain visibility into all internal and external platforms, including those run or managed by third parties.
- Run periodic access reviews based on actual job roles and usage, not what they should do or use.
- Verify asset return and data removal.
- Log and monitor post-departure activity, such as an ex-employee trying to use old login credentials.
- Document everything for audits and investigations to prove compliance.
The most important thing an organization can do to minimize risk is establish leadership. Put one person in charge of the entire offboarding process from start to finish. Give them authority to coordinate the many processes involved in employee departure. This could be someone in IT. Or it might be better for an HR representative to be in charge. Only the organization will know what works best for their culture and politics.
No matter what, businesses should treat residual access as a serious data threat. Those who treat it as a checkbox exercise instead of a true security control are making a choice, albeit a bad one. Use this power of choice wisely because there can -- and likely will -- be consequences.
Kevin Beaver is an independent information security consultant, writer and professional speaker with Atlanta-based Principle Logic, LLC. With more than 30 years of experience in the industry, Beaver specializes in performing vulnerability and penetration tests, as well as virtual CISO consulting work.
