Best practices for tracking access to IT systems
Osterman Research recently surveyed knowledge workers about their access to former employers’ IT systems.
An incredible 89% of respondents retained access to at least one
system—such as Salesforce, PayPal, email, SharePoint and other
sensitive corporate apps.
Key Osterman Research recommendations include implementing best
practices for managing employee access to IT services as well as a
rigorous IT offboarding process for departing employees.
This blog presents a template for bringing these practices to
your company. It includes guidelines for setting up internal processes
as well as specific actions to take when onboarding and offboarding
employees.
In addition, it includes recommendations specific to regulated
industries such as financial services, legal services and healthcare.
The first step to preventing unauthorized access by current and
former employees is to develop a complete understanding of your IT
landscape and the access privileges within it.
IT systems access recommendations
- Establish a security and compliance group within the company
This group should monitor two key areas: 1) who has access to
which IT services and 2) how information is being accessed and shared.
You should build this group’s role into broader IT policies so that
alerts can go out when a policy has been violated. This group should
provide compliance and security training to employees on a
quarterly/yearly basis.
- Put in place a clear set of company IT policies.
This includes policies on app usage, a list of approved sites
and services and a list of approved software and apps that employees can
use. Also, require that employees use company-provided logins for these
apps instead of personal logins.
- Provide role-based access to applications.
Create a stringent approval process for all services, apps,
and equipment that employees need. Employ two levels of approval for
each request: approval from the employee’s direct manager, as well as a
VP or account owner. Keep records in a centralized database, so you have
a clear “paper trail” of all services and equipment given to each
employee.
- Create a central repository for admin logins and passwords.
Don’t give users admin rights to their laptops. Instead,
require employees to log tickets with IT to get access to download new
software.
- Eliminate shared logins/accounts.
Assign accounts to one person whenever possible. If you have
to use a shared account for budgetary reasons, make sure you rotate out
the password on a monthly basis and employ strong password policies.
- Conduct regular audits.
Audit all your user accounts (LDAP, Active Directory, all
apps) regularly. Have a single place for running audit reports and
searching for users. Make sure you track all the apps being
used—regardless of department— so you know who’s paying for them, who
“owns” them, and what access and control IT has.
- Regularly inquire with the finance department about the contracts that are in place with external vendors.
This is a great way to identify web applications that might be in-use by the company that did not go through IT.
Employee onboarding recommendations
- Set up your accounts in Active Directory, and make sure all cloud apps are SAML authenticated.
This gives you one central location to manage employee
accounts. It also makes it faster and easier to provision and
de-provision employees.
- Use unique identifiers when creating new employee accounts.
In the system in which you’re creating the account, fill an
unused attribute field with the employee’s unique HR-assigned ID number.
This way, if a user has different name listings (e.g. J. Smith, Joe S.,
etc.), it’s easier to find all the apps with which they are associated.
- Maintain a distribution list to announce new hires.
A distribution lists ensures that all key departments (Finance,
HR, Facilities, etc.) are notified without fail when someone new is
coming onboard.
- Run a system audit when employees change departments.
Make sure you de-provision access to anything the employee no
longer needs in their new role. That way, employees always have access
to only those systems and applications that they really need to do their
jobs.
Employee offboarding recommendations
- Adhere to a strict employee offboarding checklist.
A sample checklist is included in this document.
- Maintain distribution list for terminations.
Similar to your new hire distribution list, create a list that
informs key departments (Finance, HR, Facilities, Legal, etc.) when an
employee is leaving.
- Direct the email account of a departing employee to his/her manager.
Reroute the departing employee’s email account to their manager
for the first 2-3 months so that important messages are retained and
handled.
- Terminate all employee accounts.
It is critical to terminate every employee account to every
service, both on-premises and in the cloud. If the employee is the
primary contact for an online account or project, make sure that contact
gets re-assigned.
- Review the apps saved in your employee’s single sign-on portal.
This is an excellent method for discovering apps that an
employee may have provisioned or used without IT’s knowledge. (These
“unknown” apps are the most likely to create the risk of post-employment
access.)
- Make sure to collect all company assets: laptops, phones, ID badges, software, etc.
Also make sure you collect any external hard drives or
company-owned equipment an employee may have used as part of a home
office.
Recommendations for regulated companies
If you’re in a regulated industry such as finance or healthcare,
you must put extra measures in place to ensure compliance with
governmental regulations. Here’s a list of suggestions that regulated
companies can implement to better control access to corporate accounts
and data.
- Eliminate access to outside email/internet.
- Restrict access to certain sites/apps (e.g. Facebook) to read-only.
- Only allow access to company-approved sites.
- Require employees to use desktop machines or dummy terminals.
- Don’t allow employees to take laptops or work computers home.
- Remove the ability for employees to utilize USB or external hard drives to save data from their computer.
- Implement an approval process for all outbound email. This may include requiring approval by a manager before email goes out.
- Only allow work email and information to be accessed on company-issued mobile devices.
Download the
offboarding checklist today!
Visit our website for more information and
view our IT product offerings & pricing
