The Problem With Dormant Accounts
When an employee leaves, their accounts do not always leave with them. In the rush of day-to-day operations, deactivating old logins is an easy thing to overlook. Research indicates that almost half of businesses have accounts that are no longer actively managed, sitting unused but still accessible.
An account nobody is monitoring is an account nobody will notice being used. If a former employee’s credentials are compromised, or if the ex-employee themselves retains access, those dormant logins can provide a route into your systems that bypasses all of your other security controls.
There is also a financial consideration. Old accounts for software and subscription services often continue to incur charges long after the person who used them has left. A proper offboarding audit usually uncovers costs that can be eliminated immediately.
What to Do About It
Conduct an account audit
Start with a review of all active accounts across your systems, including Microsoft 365, cloud applications, shared drives, and any third-party software your business uses. Cross-reference against your current staff list. Any account belonging to someone who has left should be disabled immediately, not just have its password changed.
Build a formal offboarding process
Access revocation needs to be a standard part of your offboarding checklist, not something that happens when someone remembers. The process should cover all accounts, not just the obvious ones like email. CRM systems, accounting software, project management tools, and any other platforms the individual used should all be reviewed.
Review subscriptions at the same time
Offboarding is a good prompt to check whether any licences or subscriptions associated with the departing employee’s account can be reallocated or cancelled. Many businesses discover they are paying for more licences than they have active users.
Schedule regular reviews
An initial audit clears the backlog. Regular reviews, at least quarterly, keep the account list current as staff changes happen. A managed IT provider can automate parts of this process and flag anomalies in account activity.
How Blowfish Technology Can Help
Blowfish Technology can conduct a full account audit for your business, identify dormant and unmanaged accounts, and put a formal offboarding process in place. As part of a managed IT service, we monitor account activity on an ongoing basis and ensure access rights are kept in step with your current team. We support businesses across the North West including IT Support Manchester and the wider region.
The Blowfish Technology team. Managed IT, cloud services, software development and connectivity for North West businesses since 1999.