I've always wondered how can we manage admin access to critical 3rd party resources (social media, SaaS CRM, etc) in big companies to mitigate:
And how is it done in real life in big companies ? For instance, how is it done in practice with the company Twitter account (or with any other important resource) ?
Unfortunately, what is commonly done is simply to share account credentials.
When possible, it is advised to have a super admin account with a manager who is not responsible for using the service directly (separation of duties) so that the active admins can come and go while management of the admins is done through a separate account. When not possible, a separate manager has a sibling admin account.
There is a new approach that is just taking off, and that is using OAuth, SSO, or similar, so that the admin accounts can be managed just like the normal company authentication directory (like AD, for instance). On top of that, there is a new class of service called the Cloud Access Security Broker (CASB) that adds this type of access layer on top of the company's cloud services. CASBs can add granular control over cloud services, including DLP, filtering, tokenization, account management, etc.
