Employee Offboarding Security Risks You Might Be Missing

Closing a leaver’s directory account, the main account in the firm’s central list of users, ends that one account. Leaver access also sits in places the directory does not control. These include outside services, shared logins, keys and tokens, mail rules, devices, work only the leaver owned and the days before IT hears of the departure. Accounts left behind by an owner who has gone, known as orphaned accounts, are one example. This guide to employee offboarding security risks is written for an IT manager, HR head or business owner. The firm is mid-size, in India or the GCC. It names where a leaver’s access can survive and how to tell whether it has. It gives no checklist or automation steps, and it leaves out people who move team and contractors.

Employee Offboarding Security Risks Begin After the Main Account Closes

A leaver’s access can still survive in six ways once the directory account closes. These six are Signisys’ groupings, not a ranking, and the article makes no claim about how widespread any of them is.

None of the six needs bad intent; each can be an oversight. That is Signisys’ reasoning.

The US guide Identity and Access Management: Recommended Best Practices for Administrators from CISA and NSA is written for administrators and is advisory in nature. Among the techniques it addresses, it lists “Assuming control of accounts of former employees which were not suspended upon employee termination.” The post on six warning signs about everyday employee accounts covers that enabled-account case. This article starts where it ends.

Orphaned Accounts: Employee Offboarding Security Risks Outside the Main Sign-In

An orphaned account is an account whose owner has left and that nobody has taken over. That is Signisys’ working description. Signisys’ reasoning is that, among employee offboarding security risks, such an account is easy to miss when a service keeps its own login, outside the main sign-in.

The NCSC’s 10 Steps guidance on identity and access management (UK, 11 May 2021) is written for cyber security professionals. It asks firms to cover wherever their identities can be used. Its example is the websites and online services that staff can sign up to with a work email address. It adds that single sign-on may be available for some online services, to “revoke access along with someone’s work account when they leave your organisation”. The same page says temporary accounts, which someone may have set up to test processes, should be “removed or suspended when no longer required”.

CISA and NSA describe locally provisioned accounts, meaning accounts created on individual systems rather than through a central sign-in. They write that such accounts can include shared accounts, vendor default accounts and “unknown accounts (e.g., ex-employee, ex-vendor)”. They also write that security event monitoring is ineffective on such accounts, and that identity federation and single sign-on drastically reduce the need for them.

To tell whether orphaned accounts exist in your firm, one Signisys suggestion is to search a leaver’s work mailbox for welcome and password-reset messages from outside services. That finds only services that sent a message, so treat it as a place to start.

Shared Logins and Things the Leaver Owned

A shared login is one username and password that several people use. A shared password belongs to the shared account, not to a person. Closing a leaver’s own account does not change it. The leaver may still know it until someone changes the password. That is Signisys’ reasoning.

To tell whether this is one of the security risks in your firm’s offboarding of an employee, one Signisys suggestion is to ask the leaver’s team, not only IT, which shared logins the person used. A team’s own shared logins may not be on IT’s list. The glossary entry on how access to systems is controlled explains the wider idea.

The leaver may also have owned something. Examples are a vendor portal login in their name, a social media or domain account, or an approval step that only they held. When the owner goes, the item can be left with no owner and no one to ask about it. That is another way accounts become orphaned, and it is Signisys’ reasoning. To tell whether it applies, ask the leaver’s manager, before the last day if possible, which logins, renewals and approvals ran through the person.

Access That Is Not an Account: Keys, Tokens and Mail Rules

Some access is not a sign-in at all. Whether closing the account ends it depends on how the service issued it. The service’s own documentation is the place to check. The four items below are Signisys’ reasoning, not a source’s list.

API keys and tokens. A key or token is a secret value that a program or person presents instead of a password. One that the leaver created may stay valid after the account closes, depending on the service. That is Signisys’ reasoning; the service’s own documentation says which.

Application grants. A person can let an outside app read their work mail or files. Whether that grant ends with the account depends on the service.

Forwarding and delegated mailboxes. A forwarding rule copies incoming mail to another address, and a delegate is someone else given access to a mailbox. A mailbox kept for handover may still hold a rule that copies mail to an outside address.

Remote access. A VPN or remote-desktop route set up for the person may rest on a separate credential or certificate from the directory account.

To tell whether any of these security risks of employee offboarding exist in your firm, ask each system’s administrator what ends when a person’s account closes, and check the answer against the vendor’s documentation.

Devices and Data Outside the Firm’s Hands

Two things sit with the leaver’s devices. A phone or laptop enrolled for work, meaning registered with the firm’s mobile device management, may keep a work profile, mail and files after the directory account closes. That holds until someone removes the device from management. A personal phone or home computer may also hold work mail, chat and files that synced to it or that the person saved to a personal storage folder. Both are Signisys’ reasoning.

To tell whether devices are among your employee offboarding security risks, ask which personal devices have work mail or files on them, and which enrolled devices belong to people who have left.

Employee Offboarding Security Risks in the Gap Between HR and IT

HR holds one date, the leaving date, and the directory account closes on another. The days between them are the gap, and each of the other five ways in this article can stay open during it. That is Signisys’ reasoning, and the article sets no deadline. This is an illustration, not a client.

CISA and NSA say identity governance systems “also provide a record of accounts and privileges associated with the individual, ensuring that access is completely removed”. Signisys’ reasoning is that, with no record of what an employee held, it is hard to show which security risks remain after the offboarding. To tell whether there is a gap, ask IT how it hears about a departure and what it receives. The guide to tying access to HR events covers a written rule for who tells IT.

Where This Article Stops and What to Read Next

This article stops at where a leaver’s access can survive and how to tell. It covers what survives beyond the directory account, not the whole subject. Orphaned accounts can arise within several of the six ways, and no firm’s own accounts were audited for them. Its sources are UK guidance from the NCSC and US guidance from CISA and NSA. No Indian or GCC rules were read for it, and it says nothing about them. It gives no statistic and no claim about how widespread any risk is. It leaves out people who move team and contractors. Separate articles cover the scored leaver checklist, the method for automating joiner and leaver access and how to compare lifecycle software.

A scored version of the leaver test lives in the identity and access management checklist. The joiner and leaver use case describes the wider picture.

Signisys offers identity and access management services, and this is a Signisys offer, not neutral advice.

Signisys provides identity and access management, helping organisations control who can access what, with single sign-on, strong authentication, privileged access and automated provisioning. Signisys agrees the exact scope for each engagement. Our Solution: Identity and Access Management (IAM). Our Service: Cybersecurity Services.

Employee Offboarding Security Risks FAQ