6

I am curious how the community here keeps track of a user's accounts. For instance, in the event of an employee transitioning from the company, how does security make sure that all user accounts the user had access to are in fact revoked. Active Directory is pretty simple, but what about all of the cloud accounts, such as Dropbox, Salesforce, etc? Do people use spreadsheets to track when access is granted or some other method?

Some clarification: For cases like Dropbox, these would be corporate accounts that utilize dropbox. For instance, sales may choose to utilize dropbox for sharing. Or for instance Marketing may have access to the company's Facebook page.

  • This is a great question, but you need to edit it to remove the "product recommendation" part. – schroeder Mar 9 '15 at 23:09
  • In the end, you need some sort of database, but spreadsheets have a drawback: they are hard to audit. What happens if someone with access to the spreadsheet hides a user's account? – schroeder Mar 9 '15 at 23:12
3

If you are allowing people to use personal accounts for external services like dropbox, you really have no control and you do not own those. Most services that offer a corporate or business version have the ability to set one or more administrators, and can disable the accounts through this interface.

From a process standpoint, some organizations do this by hand, others have checklists built into the HR management systems with workflows. Ultimately, if the credentials are not tied to AD, LDAP, Shibboleth or some centralized/federated system, you will need to manage these individually. You could use any type of database to track this.

Your organization should develop some type of service management inventory/database. In an ideal world, no third party service is used without management's authorization and these should all be tracked as part of the vendor management process (ITIL, CMMI, etc can provide guidance on the vendor or third party service provider management). From this list you should be able to make a checklist and you could check each checklist.

As part of normal user management processes, you should be doing regular access reviews/certifications to check that all current users should still be granted access. In a more mature organization, you will have processes and a paper trail or database which tracks all access authorizations, changes, and revocations. In this case, you should have a paper trail showing all grants instead of checking the list of all possible systems.

As part of a layered approach, in some cases, you can work with the third party vendor to restrict access to the application from outside of your network. In this way, the ex-employee would have to break back into your network to then access the service. Since in most cases you are likely to have at least revoked their remote access and local network access, this can help to partially mitigate the risk if you do not immediately remove access (but hopefully catch it during the periodic access review/certification).

I am not going to recommend any specific product, but you may want to google for something like "access management software for third party services" or "identity access management enterprise tool".

Partially related to this are tools dubbed "privileged identity management", but this are more generally geared towards managing shared administrator credentials.


tl;dr It's more about developing robust access management and access review policies and procedures so that way you have accountability. You should pick a system that has a strong audit trail and is backed up, a spreadsheet can easily be modified, lost, poorly version controlled, or exposed to unauthorized individuals.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.