Summary Points
-
Access is easy to grant and hard to remove: when employees change roles, old permissions often remain because no one owns the cleanup—and reviewers lack evidence to confidently revoke them.
-
Role changes are a security blind spot: unlike departures, transfers may trigger no access review, leaving employees with privileges beyond their current duties and potentially increasing the impact of a compromised account.
-
Make cleanup routine: treat every role change as a deletion event, assign each permission a named owner and expiry date, and show last-used information during reviews—with a reason required to retain stale access.
- Start small and act on evidence: review one sensitive system, focusing on employees who changed roles in the past year; ask the system owner to verify access unused for six months, while accounting for legitimate rare-use access.
What’s the Problem?
A CSO Online commentary reports that employees often keep permissions from former roles after moving to new teams. New access is usually approved quickly. However, old access may remain for months or years because no one is clearly responsible for removing it. Reviewers often approve permissions without knowing whether they are still used. As a result, organizations accumulate unnecessary access, which could increase the damage an intruder can cause if an account is compromised. The article also notes that transfers can receive less attention than employee departures, even though both require access reviews.
The writer says this happens because granting access has clear owners and deadlines, while removing it does not. In addition, mistakenly removing needed access can trigger immediate complaints, whereas the risk of retaining excess access is less visible. The commentary recommends treating every role change as a removal event, assigning each permission a named owner and expiry date, and showing last-used information during reviews. It cites security guidance and survey findings, while clarifying that breach statistics do not directly measure the risk from outdated permissions. The supplied text does not identify the writer by name.
Critical Concerns
Old access can outlive a job when offboarding is delayed, responsibilities change without permission reviews, or contractors, shared accounts, and service credentials are overlooked. This can happen in any business, from a small firm using a few cloud tools to a large company with many systems. Once an account is no longer needed, it may still provide a route to customer records, financial data, or essential operations. As a result, a former worker’s compromised credentials—or an attacker’s use of them—can enable fraud, data theft, service disruption, and costly compliance failures. Even without a breach, excess access weakens accountability and makes security harder to manage. Therefore, prompt access removal and regular reviews are basic safeguards, not administrative extras.
Possible Next Steps
When roles change or employment ends, lingering access can become an avoidable path to unauthorized activity; prompt removal limits that exposure.
Remediation Steps
- Connect HR status changes to identity and access management (IAM) workflows so access is updated or revoked promptly.
- Disable accounts at separation, and remove or adjust permissions immediately after a role change.
- Revoke active sessions, refresh tokens, API keys, certificates, and other credentials—not just the account password.
- Review privileged and third-party access, including shared, service, and dormant accounts; assign an accountable owner to each.
- Apply least privilege and role-based access, granting only the permissions needed for current duties.
- Schedule regular access reviews, require managers or system owners to attest that access remains appropriate, and document decisions.
- Monitor for stale accounts and unusual activity; alert on missed deprovisioning deadlines and investigate exceptions.
- Retain audit records and test the process periodically to verify that access is removed completely and on time.
Stay Ahead in Cybersecurity
Explore career growth and education via Careers & Learning, or dive into Compliance essentials.
Access world-class cyber research and guidance from IEEE.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
