Lesson 3.72: Joiners, movers and leavers
Access should follow a person's job: granted when they join, changed when they move, removed when they leave. In practice HR knows who left, IT knows which accounts exist, and nobody compares the two often enough. The result is the most common access finding in any audit: leavers with working accounts, accounts that belong to nobody, and people who changed teams but kept their old rights. In the lab you reconcile Northwind's HR feed with the directory export, find all three kinds, check the administrator list against the approved one and write the quarter's recertification findings.
16 min
You will learn to
- Explain the joiner-mover-leaver lifecycle
- Reconcile an HR feed with a directory export
- Find orphaned and leaver accounts
- Spot privilege that outlived a role change
- Record recertification findings with actions
Key terms
- Joiner-mover-leaver (JML)
- The three events that must change a person's access.
- Authoritative source
- The system that decides who is an employee: usually HR.
- Orphaned account
- An enabled account with no current person responsible for it.
- Privilege creep
- Rights that accumulate as people move and are never removed.
- Access recertification
- Periodic confirmation by an owner that each access is still needed.
← Anatomy of a phishing e-mail · All lessons · Managing a penetration test →