All large companies have formal processes for both onboarding and offboarding. These include granting access to corporate IT systems after hiring, and revoking said access during offboarding. In practice, the latter is far less effective \u2014 with departing employees often retaining access to work information. What are the risks involved, and how to avoid them?<\/p>\n
New employees are granted access to the systems they need for their jobs. Over time, these accesses accumulate, but they\u2019re not always issued centrally, and the process itself is by no means always standardized. Direct management might give access to systems without notifying the IT department, while chats in messenger apps or document-exchange systems get created ad hoc within a department. Poorly controlled access of this kind is almost certain not to be revoked from an offboarded employee.<\/p>\n
Here are some typical scenarios in which IT staff may overlook access revocation:<\/p>\n
Depending on the role of the employee and the circumstances of their departure, unrevoked access can create the following risks:<\/p>\n
Keeping track of SaaS systems and shadow IT is already a handful, but the situation is made worse by the fact that not all company offboarding processes are properly formalized.<\/p>\n
An additional risk factor is freelancers<\/strong>. If they were given some kind of access as part of a project, it\u2019s extremely unlikely that IT will promptly revoke it \u2014 or even know about it \u2014 when the contract expires.<\/p>\n Contracting companies<\/strong> likewise pose a danger. If a contractor fires one employee and hires another, often the old credentials are simply given to the new person, rather than deleted and replaced with new ones. There\u2019s no way that your IT service will know about the change in personnel.<\/p>\n In companies with seasonal employees<\/strong> or just a high turnover<\/strong> in certain positions, there\u2019s often no full-fledged centralized on\/offboarding procedure \u2014 just to simplify the business operation. Therefore, you can\u2019t assume they\u2019ll perform an onboarding briefing or operate a comprehensive offboarding checklist. Employees in these jobs often use the same password to access internal systems, which can even be written on a Post-It right next to the computer or terminal.<\/p>\n The administrative aspect is key. Below are a few measures that significantly mitigate the risk:<\/p>\n Technical measures to facilitate access control and increase the overall level of information security:<\/p>\nHow to take control<\/h2>\n
\n