You’d be surprised at how many outsiders are accessing your systems

Many IT leaders have no idea how many external people have been granted identity-based access to their apps and services, causing significant risk.

Organisations today are essentially porous. Of course, it’s still important to hire well but almost all enterprises also rely on outsiders. I’m talking about the contractors, freelancers, business associates, supply-chain partners, auditors, lawyers, outsourcers, managed service providers, consultants and third-party application owners that, at one time or another, needed access to your tools and data to do their jobs. They have been granted an identity that gives them privileges to use systems and many of these use cases may be valid and valuable. But external accounts can become a compliance headache if not properly managed… and ‘not properly managed’ is exactly what many of these accounts are.

There is a conundrum here. You don't want to slow down the business by becoming so risk-averse that nothing gets done, so you need to balance security against the counterweight of agility.

Changing times

The way people access systems has changed from 10 years ago: post-WWW and ever since WiFi and smartphones became ubiquitous, the age of firewalls and network perimeters has gone. And the more complex your ecosystem, the harder it is to maintain control.

Most CISOs can only guess at how many non-employees have access to internal systems. Here are some of the more eye-popping anecdotes I can share:

• One retailer thought 3,000 non-staff had identity permissions granted. Really, it was 11,000, some of whom hadn’t logged in for months and few of whom had been revalidated and certified.
• A financial services company found a vendor administrative access permission that had persisted two years after the relationship ended.
• A healthcare provider found 42,000 non-employee accounts, 60% of which had not been used in 90 days in a system that was supposed to be only for staff.

These are examples of what we call ‘hidden risk’ – what you can’t see without delving into the murky waters of identity management – and they involve potentially severe security and operational issues, from operational friction to risks of malicious attacks and costs, for example in software licensing, and auditability.

Striking a balance

We’re back to finding that balance between business flexibility and bad practices. Auditors hate risk and therefore love separation but, in a dynamic business environment, you can’t wait weeks to sanction new identities. But you can address some issues.

For example, think practically.

Great, cooperative and collaborative relationships between app admins and peers can lead to frequent access sanctioning, so this needs to be systemically managed. Similarly, recognise that employees are only one slice of the pie: think of common identity sources like call-centre operators, staffing agencies, franchises, affiliates, students, volunteers, freelancers, seasonal workers or students on work experience programmes. They are not managed like employees and they have no onboarding or HR but access lives on. So they need to be managed.

Identity Governance & Administration (IGA) is brilliant at what it was designed for, but HR has a system too… Where is the identity system of record that can work in concert with people management?

Quick wins are always welcome, so consider how to flip the model and start at the top. Who has access to the most significant systems like ERP or CRM, or data warehouses? Clamp down on who has access and why, then address duplicate accounts and shared credentials. These are issues that can be fixed quickly.

Painting a baseline

When you don't know what is valid, you can’t govern. You need to know ‘who is carrying the bomb’ – those people with the most power to disrupt governance – to bring order to chaos without slowing down the business.

Collaboration and control must coexist without bottlenecks or manual processes. Identity management is a team sport, so bring together experts: legal, HR, procurement, operations, risk, line-of-business heads, process owners, call centre managers and so on. There needs to be less reliance on IT and cybersecurity: each area must play a part.

We also need to get tough and stop granting access on a goodwill basis. Some admins today spend more time deleting old accounts than creating new ones, so we need to empower them to be proactive or they will spend their careers fighting fires.

This is especially the case at a time when agentic AI is being used as a new threat vector by attackers. Swarms of bots can be unleashed to explore every nook and cranny of the enterprise. If your permissions have not been regularly updated, old, trusted identities can act as carriers of highly damaging payloads.

External access is a board-level priority because risks like ransomware and corporate governance are so serious. You can’t secure what you can’t see and auditors demand visibility. It’s time to get serious about the threats from the outsiders who have become insiders.