explainer · Identity & Cybersecurity
Joiners, movers and leavers: where access goes wrong
Every person in a business passes through the same three moments: they join, they change role, and they leave. Each is a point at which access is either under control or quietly lost.
Joining
The new starter needs to be productive on their first day. If access is granted by request, they wait, and someone grants a bit too much to make the waiting stop. A role-based starting point, decided in advance, is faster and safer.
Moving
When someone changes team, the new access is usually added. The old access is often forgotten. Over several moves, a person can hold the combined access of every role they have had. That is the version of the problem that auditors find and attackers value.
Leaving
A leaver's accounts should close on the day they leave, across every system. In practice the list of systems is not written down, so the closing depends on someone remembering them all. Accounts that are missed can stay open for a long time.
What helps
The common answer is to connect access to the events themselves, and to the person's role.
- A starter event sets up the accounts and access that the role needs
- A role change swaps one set of access for another in the same step
- A leaver event removes everything, without needing a list to be remembered
Related service: Identity & Cybersecurity
Want to talk it through?
Tell us what you are dealing with, and we will start from there.