-1

One of my responsibilities at work is to perform periodic user access reviews. A frustrating problem has been inconsistent to poor documentation,such as it becomes difficult to map users to roles. This poor documentation and general slipshod record keeping is making it difficult for me to properly audit whether user accounts are legitimate, and increases risk of unauthorized access to company data. Some quarters ago, there was an account where no-one knew the purpose of the account and the owner of the account has long since been termed.

Like many places,access management is centrally managed through MS Active Directory at my company. Loose IAM gives rise to related headaches such as IT in the shadows.

I have talked to my manager, but our job function is not viewed favorably for obvious reasons in the company. Audit is necessarily a adversarial activity, and one will make enemies. IA and Security departments are our most reliable allies.

What are some practical ideas to improve tracking of electronic employe identities within a smaller company?

Improve this question
2
  • Can you outline what system is in place now? Do random people just add accounts to the AD?
    – nvoigt ♦
    Commented May 18, 2016 at 2:59
  • 1
    I'm voting to close this question as off-topic because it seems much more appropriate on Information Security, even with the workplace component, as your main focus seems to be account management, not getting customer buy-in.
    – Lilienthal ♦
    Commented May 18, 2016 at 6:45

3 Answers 3

Reset to default
2

Get together with the security department. Send a joint email to all staff saying that all users are to be audited. Have buy-in from the CEO (even try to get the email sent from their office), and any politics are already sorted.

Then run a list of all users. Any users who are not recognized should be suspended. If that happens to be a real user, you'll find out within a few hours from their manager when they complain.

Sell the exercise on the basis of minimum access; If a user does not have access to a particular resource, then they won't be blamed or fired if that resource is exposed in some way.

Improve this answer
2

The other answers are dead on. It is the responsibility of your department apparently to monitor for exactly these issues, and presumably to take action. If you are authorized to do so, a periodic revalidation is absolutely warranted. Each user must complete a form requesting access, with supervisor's approval, dated, and stored. It expires after a set amount of time, or not depending on your chosen policy. Get reports from AD showing last login dates, and script up account locks for anyone not logged in for X days. Get regular reports from HR of who has been terminated in the past X days and go through and manually lock their accounts, or better yet have your department added to the checklist they go through when someone exits the company.

It is imperative that they understand the ramifications of allowing a potentially malicious disgruntled former employee continuing access to their data. I would document the concerns (politely) in an e-mail, showing some specific areas of concern (e.g. your rogue unknown accounts) and including impact of a breach on the company, staff, etc. Send that to your boss or whomever needs to see it.

Then it is on them to choose what to do. If you aren't empowered to impose policies, all you can do is sound the alarm. If they choose to ignore the alarm you have done all you are allowed to do. By all means continue to motivate change, but if you are not authorized to solve the problem then you are not responsible for a failure caused by that problem.

Improve this answer
0

Obvious answer is to make accounts justify themselves periodically, with copy of the request to their managers. Those not responding get closed.

If you don't know the account's owner, you have a bigger problem and need to fix that first. But that's technical, not workplace.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .