To paraphrase the opening line of "Kevade" (Spring), the Estonian literary classic: "When Arno and his father arrived at the schoolhouse first thing in the morning, the doors had been left unlocked since the previous evening." Why is access management today the weakest link for companies?
When an employee leaves a company, they usually hand back their laptop and access card, the mailbox gets shut down, and it seems like everything is in order. Months later, though, it can turn out that they can still log into third-party systems, order goods on the company's account, or see data they shouldn't. IT and security specialists in Estonia hear stories like this more often than people care to admit.
“While the average company has gotten its cyber hygiene to a fairly good level, access rights and authorizations are in much worse shape,” says Toomas Kell, Greenergy Data Centers' head of data center operations and technology, adding that there is no cybersecurity without physical security.
A simple thing that can cost thousands
In their day-to-day work, Greenergy Data Centers employees often see how easily access management can spiral out of control.
There have been reports across the industry of cases where an employee whose contract was terminated then went into the server room and cut the cables between equipment. “That's a fairly extreme example,” illustrates Martin Rungi, Greenergy Data Centers' key account segment manager. Examples like that push data centers to invest both in countermeasures and in awareness, so that this kind of incident can't happen. There is clearly a lot that many others could learn from that too.
Quite often you see the basic housekeeping duty go unmet: someone's authorization changes, but third parties aren't informed. “For example, we've occasionally discovered on LinkedIn ourselves that someone has changed jobs, and we've immediately suspended their access rights. Unfortunately, their former employer had forgotten to let us know. Luckily, as far as we know, that hasn't had any consequences so far,” says Toomas Kell.
He adds that the customer's own responsibility, and understanding of that risk, matters: “The customer has an obligation that when someone who holds authorization toward the data center leaves, or their rights change, they let us know immediately.”
Estonia has seen several cases that a proper, working process would have prevented from turning out worse. One example that made it into the public eye involved a case where an employee allegedly walked off with their employer's coffee machine.
A more common and fairly harmless example is a former employee's Bolt Business account being left open, letting the person take taxi rides on their former employer's bill until someone notices and revokes access.
Most of the more serious stories never reach the public, because they are fairly embarrassing slip-ups tied to company reputation and personal data. “Regrettably, many companies have these stories, but nobody wants to put their name on a cautionary tale. The reality is that plenty of incidents have happened where an employee caused harm to a former employer simply because it was possible, and the same goes for current employees overstepping the limits of their authorization,” adds Rungi.
The ISO standard and the "sick leg"
According to Rungi, the topic gained new momentum for them with the 2022 version of the ISO 27001 information security standard, which sets more specific requirements for audited organizations on documenting and managing access rights.
“Before, you could just open an access account and later close it. Now you need to record what basis you granted that right on, where the request came from, whether it came from a person with signing authority, and how you eventually closed it,” he explains.
That means audited organizations have to change their existing routines and mindset. Rungi compares the situation to a sick leg: “Your leg is sick, and ten doctors have treated it fruitlessly for years. At some point you have to decide: do you amputate the leg and fit a prosthetic that doesn't hurt, or keep treating it without success? It's the same with processes: do you build a new, working system, or try to fix the old one, built by people who are no longer even at the company?”
The database can even be a spreadsheet
Toomas Kell adds that not every incident stems from malice; sometimes someone simply forgets to revoke authorization somewhere. As a result, necessary notices and information can reach the wrong person or never arrive at all. “For example, if a law or regulation changes and someone should have acted on it, nobody may know about it, and the necessary steps go undone. That causes harm, not always directly financial, but certainly in time lost and confusion, which affects the whole company's work,” Kell explains.
Access management isn't only the IT team's concern. It needs to be part of the company's overall process, just as logical as signing or ending an employment contract.
“When you hire someone, you grant them rights and record those rights. When they leave, everything happens in reverse: you revoke those rights and record again that they were revoked,” Kell describes. “Ideally you have registers or databases where you can see, at any moment, who is allowed to do what.”
It doesn't have to be a complicated system. “It can even be an ordinary spreadsheet,” says Kell. “The main thing is that you know who has access, to what, and what they can do within it.”
According to Priit Lahi, head of Greenergy Data Centers' operations control center, the most important thing is that every step leaves a “trail of breadcrumbs”: a record of why someone was given a right and why it was taken away. “If that documentation piece is missing, the system quickly starts to break down. If after some time you need to check or fix something, the answers simply aren't there,” he explains.
The comfort zone is the biggest enemy
In general, companies know about these risks but don't want to deal with them. “It's not a sexy topic. Nobody wants to start unraveling an old process, because it's tedious and complicated and causes friction,” says Rungi.
He adds that people often stay in their comfort zone, in the public sector for example: “Instead of fixing the process and making the routines work, another specialist gets hired, who, to put it vividly, digs through a pile of papers. In reality, all of that could just be organized simply in a database.”
Sorting out and automating processes doesn't require a large financial investment, in his view, but rather the courage to acknowledge the bottleneck and the willingness to make the decisions needed to carry out change. “If you want to renew your ISO certificate, you have to sort these things out one way or another. You can do it today or in two years, but there's no way around it,” he says.
How to get started?
The simplest step, in Rungi's view, is to start by mapping out the onboarding and offboarding processes.
Toomas Kell adds that as a starting point you need to know where you stand at all: “Map out which systems and access rights employees have. Then you can start cleaning up: the old ones out, the new ones in correctly.”
“Document every right a person receives when they join, and build the reverse process for when they leave. The same goes for customers and partners: don't let ignorance or carelessness leave people still operating under old rights years later,” he says.
And finally, Lahi believes, you need to find the right tool. “Whether it's a bought-in solution or a system you built yourself, the main thing is that it fits the organization and can integrate with third parties where needed,” he says. “And every process needs a clear start and a clear end, with no room to cut corners.”
Simple things equal a good night's sleep, as they say in IT
Greenergy Data Centers' leaders stress that the core issue is really discipline. “These are small things that make for a better night's sleep,” Rungi says in closing.
Access management may not be an exciting topic, but it's a place where carelessness can cost even more than a cyberattack.