Thankfully there are software tools available to assist with provisioning. They allow companies to keep track of all assets that are issued to staff. This includes physical assets such as cars and computers, entitlements such as club memberships and discounted canteen rates, and access to internal and third-party computer systems. Thus when an employee leaves the company or changes his or her job, it is easy to discover which assets should be denied, recalled, disabled or returned. All of this helps with audit compliance, of course, and also saves money. After all, why buy a new copy of Microsoft Office for an incoming employee when there are four licenses available that were previously used by staff in another department but which are now no longer required.
Thereís no point in continuing to pay for a Bloomberg or Reuters subscription for someone who previously worked in the investments office but has now moved sideways into a marketing role. An automated provisioning system can spot this change of role and automatically alert the person who manages the subscriptions.
When someone leaves the company, provisioning software means that all of their computer accounts can be shut down in a single action. This is especially important in the case of a dismissal, where leaving a single electronic door open can put the company at risk from the proverbial disgruntled employee. Plus, there is a clear list of tangible items available so that the employee and the employer know which items need to be returned.
Automated provisioning management systems can be especially useful where temporary staff, or those on relatively short contracts, are employed. Itís convenient merely to create all-powerful network usernames of, say, temp1 to temp20 and allocate them to temporary staff as required. Such a practice is commonplace but is highly dangerous because it becomes impossible to pin down unauthorised access to a specific person. It is also inadvisable to grant users permissions to systems that they have no need to access, even if you are confident that theyíll probably never discover those systems. Even if the temps donít know about them, other long-standing staff will. With an automated provisioning system, the company simply defines a set of temporary job functions and the system can then create (and, just as importantly, revoke) usernames with the correct set of privileges when required.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.