Cascade Industrial: Contractor Revocation and Shared Vendor Access
Cascade Industrial operates 14 plants with converged IT/OT networks. Its 25,000 workforce includes 6,000 contractors. An inventory found 1,100 privileged accounts, 210 service accounts with non-expiring passwords, and 38 shared vendor VPN accounts used across three plants. Plant engineers often share local admin passwords in a spreadsheet because the PAM rollout stalled. A terminated contractor retained VPN access for 47 days and downloaded 2 GB from a file share; the near-miss was found by an OT vendor, not by monitoring. HR termination feeds reach IT in 3 days for employees and 10 days for contractors. The board approved $2 million for identity risk reduction over 12 months but wants KPIs, not a tool list. Plant managers resist session recording because it may capture live production screens and union data.
1. Rank Cascade's top identity risks and justify why the shared vendor accounts and service accounts outrank the 14-plant PAM rollout.
Read the worked answer
Shared vendor VPN accounts rank first. Thirty-eight accounts used across three plants mean Cascade cannot attribute activity to a person or company, cannot revoke one vendor without disrupting others, and cannot investigate the 2 GB download. The 47-day retention proves the lifecycle failure; the shared accounts prove the attribution failure. Together they create a direct path from a terminated or malicious vendor to OT file shares.
Service accounts with non-expiring passwords rank second. Two hundred and ten credentials that never rotate are credential-stuffing and insider-risk multipliers, and they often carry high privilege. They are also invisible to normal joiner-mover-leaver processes. The blast radius spans IT and OT, and the fix is bounded: inventory, owner assignment, rotation, and vaulting.
Shared local admin passwords rank third. The spreadsheet is a real problem, but local admin on a plant workstation is narrower than a VPN account that reaches file shares across plants. It becomes urgent where the same password is reused across sites.
The full PAM rollout ranks lower as a starting point because it is a 12-month platform program that will not fix attribution this quarter. Sequence risk reduction by blast radius and reversibility, then use PAM to sustain the fixes. The board's KPIs should measure unique identity, revocation speed, and privileged coverage, not tool deployment.
2. Build a 12-month roadmap with 30-, 90-, 180-, and 365-day milestones that reduces the top risks while respecting plant operations and the $2 million budget.
Read the worked answer
Days 0-30: freeze new shared vendor accounts; inventory every account's owner, users, and reachable systems; issue unique named vendor identities for the three affected plants; require MFA and time-bound access. Start daily contractor feed reconciliation and a same-day revocation SLA, with a manual bridge until automation. Assign owners to the 210 service accounts and identify which are truly non-expiring versus orphaned.
Days 31-90: retire the 38 shared VPN accounts and replace them with per-vendor, per-engineer accounts brokered through a VPN gateway or PAM. Vault the local admin passwords, starting with the highest-reuse sites. Rotate the 50 highest-risk service account passwords. Publish a revocation runbook and test it with a terminated contractor scenario.
Days 91-180: extend privileged access management to plant domain admins and OT jump hosts, with session recording scoped to privileged sessions and privacy controls agreed with unions. Automate the contractor feed to under one hour and measure time-to-revoke. Complete service account rotation for the remaining 160.
Days 181-365: integrate OT remote access into the same identity governance process, add behavioral monitoring for vendor sessions, and run an independent sample of 25 leavers. Use remaining budget for PAM expansion, not parallel tools.
Budget guardrails: prioritize identity lifecycle automation and PAM over new analytics. Reserve 15% for plant-specific integration because OT environments vary.
3. Define five KRIs with targets and thresholds, and explain how you would address plant-manager resistance to session recording.
Read the worked answer
KRIs should be leading and actionable. One: percentage of privileged access under unique named identity, baseline 55%, target 95% by month 9, red below 80%. Two: median time from termination to access revocation, baseline 10 days for contractors, target 1 hour, red above 24 hours. Three: number of shared accounts, baseline 38 VPN plus spreadsheet-shared local admin, target zero VPN shared accounts by day 90, red if any new shared account appears. Four: percentage of service accounts with rotation under 90 days and a named owner, baseline 0%, target 100%, red below 90%. Five: percentage of vendor sessions recorded and reviewed, target 100% recorded for privileged OT access, red below 95%.
Resistance to session recording is best handled by narrowing the scope and addressing the stated harm. Record only privileged sessions on jump hosts, not continuous screen capture of production workstations. Mask or exclude windows that show union data, and publish a retention policy with limited access. Give plant managers a review role so recording is used for coaching and investigation, not surveillance. Run a 30-day pilot at one plant, share incident outcomes, and let the works council review the configuration. If resistance persists, fall back to command-level logging plus keystroke-free session metadata, but do not abandon attribution. The board KPI remains unique identity and recorded privileged sessions.