1

Today I find myself cleaning up web accounts for a user whose last day was Friday. This user had been with us awhile and has a decent number of online accounts. I don’t like the idea of old accounts sitting out there, so I do my best to close every account. While we have some accounts as business accounts with admin access, there are many accounts that simply do not have this option and I find myself logging in (I have all the credentials,) to delete or deactivate the accounts. Some of the accounts, I have to call or email to get deactivated. Something that I would like to discuss with my supervisor is implementing a password manager to make keeping track of those accounts simpler. (I have the credentials from the saved passwords in the browser.)

I am wondering today how some of you handle this? Do you have to go through each one yourself? Is this responsibilty passed off somehow? (I don’t I have that option myself and I would have time to be able to do this.) Maybe there is a better solution for this that I have not found yet…

8 Spice ups
2

For these web accounts do you and other IT team members have admin access to them? Or are these accounts that were setup by the employee?

We’ve got a lot of apps that use SSO so lots of them support SCIM provisioning & deprovisioning, which is nice. But we’ve got some that need manual deprovisioning so we login to each of those apps to disable or remove the account. Our IT team handles this exclusively for the sake of auditing purposes to confirm they were deactivated. A password manager will be a huge help in tracking the accounts that exist.

1 Spice up
3

Some of them, we have admin access. Those don’t concern me since the admin access makes it easy to add or remove users.

My concern is with accounts set up by the users. There are some departments that have accounts that I would have no clue about. This former employee that I am cleaning up accounts for today is a good example of that. He was into a woodworking category of our business and the first that I learned of these accounts were this morning as I start checking into what he had. Some of the companies that we deal with have online accounts, but they set them up and delete them internally, requiring me to email or call them for removal.

4

For accounts setup by users for systems that we don’t manage we don’t bother trying to find these accounts and delete them. We’ll generally keep an email account active for 30 days to see if there’s any email that’s needed to look over. Especially in your case where there’s a long-time employee who likely has lots of important archived information attached to their account.

2 Spice ups
5

So, you don’t consider it an issue to have an old account associated with an unknown (to us,) website still open? I have done that in the past, but my concern was that some of the accounts may allow purchasing on behalf of the company or have credit card info saved as a payment.

1 Spice up
6

I see where you’re coming from as the security perspective to protect your company from fraud/theft and misuse of spending. If I know about it, I would definitely do my due diligence. But the credit card is tied to the business it should be renewed annually. And this is likely something your legal, finance, & accounting teams should have knowledge of.

Let’s say someone does make purchases after they are no longer an employee of the company. They just opened a huge legal case against themselves. Will it cause a problem, yes. But if it’s that important to offboard these types of accounts this should be a standard of an offboarding procedure. However, I don’t go out of my way to dig through previous employee email or browser data to find login information unless it’s business critical. If you have to do this with every employee, that’s just a huge time commitment that I currently don’t have. Wish I could be more helpful. Sounds like a big predicament, hopefully most of the employees don’t have this type of access to purchase for or on behalf of the company.

2 Spice ups
7

I appreciate the sentiment. I don’t feel that it’s typically a big deal. Most of our users save their passwords in a browser, so it’s easy to export a csv list of all the accounts. I’m not a big fan of browser saved passwords, but we have not invested in a password manager yet, so that is what is being used.

This particular user had 80 rows in the csv file, so there are a lot of accounts to deal with. A typical employee here probably only has a quarter of that.

2 Spice ups
8

I definitely agree with your concern, but like @tb33t mentioned, I think you can only do so much. Our off-boarding includes cancelling the user’s company-issued credit card and any accounts we have admin access over. Most of those had no ability for the user to change the shipping address, anyway, so any goods ordered would come right to our door. We do have the users’ managers monitor the email account for at 90 days after termination, so that would pick up any order acknowledgements or attempts to change login/profile information, but that’s about the best we can and will do.

2 Spice ups
9

For the future: each employee with purchasing authority should have their own credit card with a unique number.

Do not share cards or online accounts among employees, so a card can be deactivated without affecting other employees and the terminated employee loses spending ability in the online accounts he had access to.

2 Spice ups
10

Wow…companies do this?? Yikes!

1 Spice up
11

It isn’t at all foolproof or strictly enforceable but I roundly discourage our users from independently creating any website accounts with their corporate email address in the first place.

If access or an account is required, IT should be notified and included so that said login may be documented. Additionally, I make regular use of per-website aliases so that if an employee’s responsibilities change (or they leave the org) I can quickly reassign that alias to their replacement.

For example, rather than letting jimsmith@ourorg[.]com sign up for an account on supersaas[.]net I create an alias, “supersaas@ourorg[.]com” under his account and establish login as the alias. When Jim leaves I can easily reassign the alias and have no need for closing or re-establishing access.

3 Spice ups
12

That is actualy a really nice way to do that, it also means that password resets don’t go to jim, they go to the alias account, which you probably have already gotten control of.

The trick is to get users to stop doing shadow IT :stuck_out_tongue_winking_eye:

3 Spice ups
13

Each of our users has use of their own password manager. It’s part of our policies and procedures that all external service credentials are stored this way.

At the time of resigning, the off-boarding process starts, and their departmental manager is responsible for various tasks in this process, including acquiring the leaver’s password manager, and credentials for access. This is confirmed as completed, by the manager in the leaving form. The manager is also responsible for disabling their external service accounts where appropriate - again confirmed in the form.

It’s non-technical; it amounts to managing staff members, so as much as possible we’ve left it to the department heads to sort out, and if they fail to do it, they’re responsible.

2 Spice ups
14

You said it. There’s always that one who wants to operate under the premise that it’s easier to obtain forgiveness than permission.

1 Spice up
15

I totally get this sentiment. However, with our company, details about who and how these accounts should get created are not specified and there is no policy governing it. I have been working with our CEO to create better policies for things like this, and that is part of the reason I posted this question initially. (The main reason was that with so many accounts for this user, I just felt there may be a better way. :grinning_face_with_smiling_eyes:)

1 Spice up
16

And that is the first step in the quest for excellence :slight_smile:

1 Spice up
17

We tried this previously, but found out quickly that there was no accountability down the road. If we needed to know who made what purchases a year or two ago, there was almost no way to tell. We ended up going back to named accounts, but that has its own issues, as evidenced by this post.

1 Spice up