Tighter Security Through Automated Privilege Revocation

How Britive Makes it Possible to Secure Onboarding & Offboarding For Employees & Contractors In The Cloud

Standing privilege access is one of the most dire IT security vulnerabilities facing public and private organizations today. We at Britive cite this stat a lot, but it really can’t be emphasized enough: Gartner now sees inadequate management of identities, access, and privileges as the most threatening attack surface in cloud environments, and expects security failures involving privileged identities to rise to 75 percent by 2023, up from 50 percent in 2020.

Let’s focus on that word inadequate. There are many ways to inadequately manage access entitlements, secrets and privileges. You can hand out too many. You can fail to track whom (people) and what (machine identities) have access to which resources. Perhaps most importantly: you can grant open-ended privileges and then fail to revoke those privileges once they’re no longer necessary. Most commonly, this occurs when an employee or contractor leaves the organization, or cycles into a different role within the organization.

The standing privilege threat when employees leave

Most companies are great at onboarding. After all, getting new employees up and running, and making productive contributions, is a primary focus of human resources and IT teams everywhere. Offboarding, however, is a different story. Especially today, as so much day-to-work—and especially product and service development activity—goes on in the cloud, tracking staying on top of cloud-access privileges is monumentally difficult. But when an individual leaves the organization, and their privileges to cloud resources remain in place, it’s tantamount to leaving an open door into the most sensitive IT resources and data within the company.

So, what can be done? We answer this question in the new short use case paper from Britive. In it, we review how so many companies today are using hundreds or thousands of cloud services, and that typical DevSecOps operations can easily generate thousands of data access events every day. The result is that each human and machine user ends up having multiple identities and standing privilege sets sitting vulnerable to exploitation. If those privileges are not revoked or expired when an employee or contractor leaves the organization, that massive threat surface remains in place indefinitely.

LPA and ZPA access management for users in the cloud

The most effective way to manage the identity lifecycle is through the maintenance of least privilege access (LPA) and zero-standing privileges (ZSP) for those users while they are working in the cloud. Likewise, with the complete removal of accounts and access when terminated employees and contractors leave the organization. These offboarding steps are especially critical in today’s dynamic work environment, with employees and contractors frequently joining and leaving your organization. With the Britive Dynamic Permissioning Platform, you can quickly and easily grant role based-dynamic access control (RBAC) to new users, manage their permissions while they are working for your organization, and quickly and completely offboard them when they leave.

Download your own copy of Secure Onboarding & Offboarding For Employees & Contractors In The Cloud, and get the full story of how Britive is making automated offboarding of cloud access privilege a powerful new solution for more effective IT security.