{"id":54884,"date":"2022-10-28T13:00:00","date_gmt":"2022-10-28T17:00:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=54884"},"modified":"2024-01-29T13:17:51","modified_gmt":"2024-01-29T18:17:51","slug":"improper-offboarding-poses-significant-security-risks","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/improper-offboarding-poses-significant-security-risks","title":{"rendered":"Improper Offboarding Poses Significant Security Risks"},"content":{"rendered":"\n

October is Cybersecurity Awareness Month, and this year\u2019s theme is See Yourself in Cyber, which focuses on the individual\u2019s role in cybersecurity. While cybersecurity can feel complex and inaccessible to the average person, the reality is that everyone has a role to play in security, from executives to the IT team to end users. This month, the JumpCloud blog will focus on helping you empower everyone in your organization to do their part regarding cybersecurity. Tune in throughout the month for more cybersecurity content written specifically for IT professionals and MSPs.<\/em><\/p>\n\n\n\n

\n\n\n\n

Many organizations spend quite a bit of time onboarding new employees and making sure they have access to everything they need; however, the same care is often lacking when it comes to offboarding. Whether a long-time employee suddenly leaves on bad terms, a contractor is no longer being utilized for some period of time, or an employee goes on leave, improper offboarding or suspension of that user\u2019s permissions and access poses significant risk for your organization.<\/p>\n\n\n\n

Offboarding and deactivating a user\u2019s identity can be a manual and time-consuming process, yet it is also very time-sensitive and sometimes requires IT admins to be available at a moment\u2019s notice. Not every employee gives notice prior to leaving, and unforeseeable events can happen that force admins to scramble at the last minute to deprovision that user\u2019s access to company resources.<\/p>\n\n\n\n

This process becomes even more difficult if your organization needs to provide access to IT resources for temporary workers like contractors and interns, or has full-time employees that may need to be temporarily offboarded or have their IT resource access suspended rather than be permanently offboarded due to personal events like marriages, births, family care, overcoming an illness or injury, and more.<\/p>\n\n\n\n

Most Companies Struggle With Offboarding<\/h2>\n\n\n\n

Improperly offboarding employees is a dangerous game to play, yet, according to TechRepublic<\/a>, 48% of organizations said they are aware that former employees still have access to corporate networks. Further, 20% of organizations say they’ve experienced a data breach that\u2019s linked to former employees.<\/p>\n\n\n\n

These stats tell us that improperly offboarded employees are a predominant threat to organizations; however, the tools and resources needed to fix this issue aren\u2019t there. The missing link here could be a lack of time, no simple way to quickly offboard or suspend user access to all IT resources, and\/or lack of insight into the security risks posed by inadequate processes. It puts a spotlight on the notion that offboarding is as much a security issue as it is an operational one for IT.<\/p>\n\n\n

\n
\"\"<\/figure><\/div>\n\n\n

Another important finding from TechRepublic is: <\/strong><\/p>\n\n\n\n

Half of IT leaders said that ex-employees\u2019 accounts remain active for longer than a day after their departure, 32% said it takes a week to deactivate an account, and 20% said it takes a month or more. Another 25% said they don’t know how long accounts remain active once the employee has left the company.<\/p>\n\n\n

\n
\"\"<\/figure><\/div>\n\n\n

These percentages pose a significant problem for the organizations that fit into these stats. It only takes one angry ex-employee, one ex-employee that\u2019s simply being careless with the handling of their credentials, or one employee on leave that still has active access to make damaging changes in some shared resource, even though they weren\u2019t there for the last best practices discussion.<\/p>\n\n\n\n

Case Study: Improper Offboarding and Compliance Violations<\/h2>\n\n\n\n

Here\u2019s a real world example of how improper offboarding of employees and contractors can lead to considerable compliance violations, substantial fines, and the subsequent loss of public trust.<\/p>\n\n\n\n

Pagosa Springs Medical Center (PSMC)<\/h3>\n\n\n\n

In 2018, Pagosa Springs Medical Center found itself at the epicenter of a major HIPAA violation which ended up costing them $111,400 \u2014 all because they did not properly offboard a terminated employee.<\/p>\n\n\n\n

After their termination, the former PSMC employee retained remote access to PSMC\u2019s web-based scheduling calendar, which contained patients\u2019 electronic protected health information (ePHI). The investigation revealed that PSMC impermissibly disclosed the ePHI of 557 individuals to this former employee.<\/p>\n\n\n\n

HIPAA calls out the need for a formal offboarding process under the security rule section – \u00a7 164.308(a)(3)(ii)(C): \u201cImplement procedures for terminating access to electronic protected health information when the employment of a workforce member ends.\u201c<\/p>\n\n\n\n

Source: HHS<\/a><\/strong><\/p>\n\n\n\n

HIPAA is just one standard that can easily be violated due to improper offboarding \u2014 there are many others out there with similarly severe consequences for non-compliance.<\/p>\n\n\n\n

A Quick Offboarding Checklist<\/h2>\n\n\n\n

Even at organizations where offboarding is seen as a fairly quick process, i.e. less than a couple of hours, the risk of that ex-employee or another bad actor taking advantage of existing access is still prevalent. <\/p>\n\n\n\n

TechRepublic also found that 70% of IT decision makers surveyed said it can take up to an hour to deprovision all of a single former employee’s corporate application accounts. Keep in mind, this does not include revoking an employee\u2019s access to their devices and networks.<\/p>\n\n\n

\n
\"\"<\/figure><\/div>\n\n\n

To combat this and improve your organization\u2019s security posture, it\u2019s helpful to put steps in place that improve offboarding efficiency<\/a>. One of these steps should include an offboarding checklist to ensure that no loose ends are left after an employee\u2019s departure.<\/p>\n\n\n\n

Your offboarding checklist should include deactivation of access to:<\/strong><\/p>\n\n\n\n