In one case, six months after the company manager left office, his former colleague found out he was still using WiFi and checked the backstage to find that the account number had been useless.——The personnel system was not connected to the IT system and the separation process was completed, but the network account number remained.
Such issues sound to be a matter of managing processes, but in practice they are also very relevant to the design of certification systems.
Issue I: Lack of integration between certification and personnel systems is a root cause
If the network certification system accounts are independently managed and no interfaces exist with HR systems, OA systems or door-restricted systems, the IT department will operate manually in multiple systems for every new person and every older person who walks.
Under this pattern, the leaking operation is a approximate event.
I've seen one of the most exaggerating cases: a company, IT and HR, uses two separate systems, HR manages one set of OAs, IT manages another set of network accounts, and there is no connection between the two systems. One day, HR checked the roster and found that the number of online accounts at the back of IT was more than 30 times higher than the number of people on board.——All were separated for more than three months but the network account number remained.
Therefore, it is important to have a standard personnel account synchronization interface when selecting the certification system. The mainstream HR system has standard API or file import methods, and the certification system will suffer from later shipments if it does not support the docking. It is recommended that the vendor demonstrate the process of synchronizing the account number during the selection phase to see whether it can be done: staff entry into service, automatic creation of network accounts, separation of employees, automatic de-entry of network accounts.
Issue II: The management of the validity of visitor accounts is easily overlooked
The management of the visitor accounts is more chaotic than that of the staff.
Visitors' access is usually temporary passwords or text-letter authentication codes, but are these numbers automatically recovered after they have run out? How long does it last? Who can approve visitors' access?
I've seen a case in the writing room: property issues temporary accounts to each visitor, but these do not automatically expire and as a result over three years later, visitors account numbers have accumulated more than 3,000, of which over 1,000 are active.——The accounts of all those who have left are still in use, at great risk.
It is recommended that the automated expiry mechanism for visitor accounts be introduced in the certification system. If you have a temporary account number, for example, it will not be valid after 72 hours.
Issue III: The node for recovery of network accounts must be included in the separation process
Many businesses have exit processes: HR launch, departmental confirmation, IT recovery equipment, and the unserviceable mailbox."Disable network accounts"This step.
I have previously performed a security audit for one client, and found that they have over 70 employees who have been separated for more than six months.
It is recommended that network accounts be recycled as standardized checklist and preferably linked to HR systems for automatic triggering. Once the status of the staff becomes"Separations", network accounts automatically are disabled and do not require manual intervention.
Issue IV: Periodic account audits
Even if the system had an automated recovery mechanism, it was recommended that a quarterly account audit be conducted: all active accounts should be exported and compared to the active personnel list for any exceptions.
This is not a very costly matter, but there are many potential security risks to be identified."Active staff"But actually, he's been out of service for six months.——Description of the system interface still exists.
The accounts audit focused on several points:
One is a long-term inactive account that has not been disabled. For example, there are no online accounts for more than 30 days but the account status remains active, either because equipment is abandoned or when separations are pending.
Second, accounts that are frequently registered and written off during the same period. This may be for other purposes by a batch register.
Third is the account number for which you have an unusual configuration of privileges.
Issue 5: Clear the difference between equipment and account numbers
Some companies, for reasons of strict regulation, attach a fixed number of equipment to each account, which is not allowed access.
For example, a company has tied two pieces of equipment to each employee’s account, but the employee computer has replaced the new equipment or it has issued new phones that require IT to manually untied the old equipment and to bind the new equipment. Nearly one third of the monthly worksheets are for this type of operation.
It is recommended that the equipment binding strategy be flexible: For example, support for three to five sets of equipment or the use of equipment type separation (automatic release of office equipment and personal equipment requirements) would reduce the daily transportation workload.
The network certification system is not just a technical tool, but it is connected to the entire process of people-managed. Account life cycle management is done, actually providing a safe line for businesses. Not doing well is a risk point that could be hit at any time.