Why does old access outlive the job?

Publisher excerpt From CSO Online

Old access persists beyond its intended purpose and most organizations never monitor it. New access rights arrive within a day of a request. Old rights get revoked, if they get revoked at all, only upon prompting someone. Tools that assist employees in confirming, rotating and vaulting their service accounts have taught me again and again that removing access has to be as thoughtful as granting access. Security professionals can bridge this chasm with simple changes to their policies for role moves and access reviews. This happens all the time. An employee moves from one team to another. The new manager approves the access needed for the new role within a day, and the person is productive by lunch. The access from the old role stays. After months, access review has one query only: “Do you still need it?” The reviewer sees the name next to the entitlement, but nothing on the dashboard shows whether it has been used since the move. It is hard to click no, because something might get broken. They have never been bothered to click yes. Thus, they click yes, and it’s fine by them. Why is granting access easy but removing it hard? Granting has an owner and a deadline. A manager submits a request, an approver clicks yes and the process is completed in just a few hours since someone is involved in it. Removal does not have any of the two. Nobody opens a ticket when permission becomes unnecessary, as the only person who notices will not submit the ticket for lack of reason to do it. The cost of maintaining the permission is high, but it is not visible and it comes in the future. The incentives work the same way. Nobody evaluates how low an access level their team maintains, while a permission that was mistakenly removed and became necessary results in an irate support ticket submitted the same day. And this is something that has to be done via reviews, but, in my opinion, is not done like this. And, at least in all attestation and recertification activities I was involved in, there is simply a basic question for the reviewer: is access still valid? Saying “yes” is not really difficult — access was granted, there were no actions following and reviewing several hundred takes less time than investigating one particular access. This is not what will appear on your screen. When reviewing account names, you do not know whether they were used last week or last year. Role-based access control helps here, but the problem is that, when a user changes his role, his role gets updated, but not the direct access, groups and folders he acquired during the time. What does leftover access actually cost? I have to be quite careful here, as this metric does not reflect the access that remains. The 2026 Verizon Data Breach Investigations Report demonstrated that exploitation of vulnerabilities was the most frequently used method of the breach, making up 31% of all breaches, while the previous leader — abuse of credentials — was reduced to 13%. However, I want to emph…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.