The IT infrastructure of organizations today spreads far and wide. At any given time, employees have access to multiple accounts and sensitive data, and this is expected for day-to-day business activities. If accounts and user privileges are not managed correctly, this could lead to data breaches. An effective security plan should incorporate removing access to safeguard your business against security threats.
There are significant dangers of retaining old and unused user accounts, such as increasing your attack surface. There are also risks of insider threats. You should follow a zero-trust model where access to networks, applications and accounts are only permitted if you can verify a user’s identity and privileges, minimizing the impact of an insider or external threat from accessing your data. Any ex-employee with valid credentials could access your network at any given time, even after they’ve left your company. All it takes is for one disgruntled ex-employee to compromise your organization by deleting, stealing or sharing sensitive and confidential data.
The theft of intellectual property can also be harmful for your company. Not removing user privileges could lead to competitors taking advantage of employees that steal business-critical information and take them to their new roles, placing your organization at a disadvantage.
Your business should be proactive once it is known that an employee is leaving the company. All organizations should have an account disablement policy in place that ensures user accounts and privileges are disabled and removed once an employee's contract is terminated. Additionally, physical security measures should not be ignored, such as revoking access to buildings and offices, to protect your organization from data theft or loss.