Stale job access lingers because nobody owns removal
Original title: Why does old access outlive the job?
The author says role transfers should trigger a deletion review, with named owners and expiry dates on extra rights.
A CSO Online commentary argues that new access is granted quickly while rights from an old role often remain because removal has no owner or deadline. The author says attestation reviews only ask whether access is still valid and do not show last use, so reviewers tend to approve it. NIST SP 800-53 Rev. 5 controls AC-2 and AC-6 are cited as requiring transfer and termination handling and least privilege. Suggested fixes are a deletion task on every role change, a named owner and expiration for each extra permission, and treating transfers like terminations.
Unconfirmed: The password survey is an online opinion poll the author treats only as an indicator, not proof of breach impact.
- The author cites a March 2023 PasswordManager.com survey of 1,000 US workers.
- In that survey, 58% who used a former employer’s passwords said they never changed them.
- The author says the 2026 Verizon DBIR figure is unrelated to obsolete permissions.
- Direct grants, groups, and folders can survive a role-based access update.
- Organizations
- NIST
From the original article
6 min read at csoonline.com
Old access persists beyond its intended purpose and most organizations never monitor it. New access rights arrive within a day of a request. Old rights get revoked, if they get revoked at all, only upon prompting someone.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.