An Access Review That Approved Everything
A 600-person property insurer has completed its quarterly access review. Three findings emerged. First, a local administrator account named admin_ops is shared by six infrastructure engineers; the password sits on a team wiki page that is itself protected by the same account. Second, an account belonging to a contractor who left four months ago still has VPN access and write access to a shared drive containing claims data; nobody flagged it because the contractor's manager left the company in the same month. Third, 22 accounts have no identifiable owner in the HR system. The review is performed by sending each manager a spreadsheet of their team's entitlements; average completion time last quarter was under three minutes per manager, with a 98% approval rate. The jump host used for administrative work accepts password-only authentication from the corporate LAN. The audit committee meets in five days and wants a status update on 'the access review finding'.
1. Set out the actions you would take in the next 48 hours, in priority order, with a one-line justification for each.
Read the worked answer
Ordering rule: revoke standing access you are certain is unauthorised first, then treat shared credentials as already compromised, then handle ambiguous accounts where action could break production.
- Disable the contractor account now - revoke VPN, active sessions and tokens. The person has no legitimate need, the access is write-level to claims data, and the fix has no business dependency. Notify HR and the manager's successor afterwards.
- Rotate admin_ops and remove the wiki page - the wiki is protected by the credential it stores, so treat the password as public and assume it may have been used since an unknown date. Pull authentication logs for the account.
- Start the replacement, not just the rotation - a new shared password is not a fix. Interim: unique credential in a password vault with checkout logging. Target: named admin accounts per engineer with PAM brokering.
- Reconcile the 22 unowned accounts before disabling - these may include service accounts whose outage stops a claims system. Confirm with HR plus the system owner; disable confirmed-human accounts in 48 hours, service accounts on a documented plan.
- Harden the jump host - MFA and key-based auth, source-IP restricted to admin VLAN. If that cannot be done in 48 hours, put a compensating firewall rule in place and log the exception with an expiry date.
- Open a review of the contractor's four months of activity - and check whether logs even reach back that far; if they don't, that is a finding in its own right.
2. The audit committee wants to know whether the review process is providing assurance. How do you answer, and what would you change?
Read the worked answer
Answer plainly: no. The control is designed but not operating effectively - that is a deficiency, not a clean result. The evidence is in the numbers: a 98% approval rate, under three minutes of average review time per manager, 22 accounts with no owner, and a four-month-old leaver caught only by accident. A control that essentially cannot fail is measuring nothing; managers are bulk-approving a list they have no basis to interpret.
What to change:
- Tier the review. Privileged, claims-data and payment-system entitlements get named, per-entitlement attestation; low-risk access can be bulk-confirmed.
- Automate the population. Feed joiners, movers and leavers from HR and the contractor system into the identity platform. Leaver disablement should not depend on a quarterly spreadsheet.
- Define cadence by risk. Privileged access quarterly, standard access annually, plus trigger-based reviews on transfer or role change.
- Add independent testing. Sample 25 accounts and verify with both manager and system owner; sample 10 recent leavers and measure time-to-disable.
- Report metrics that are allowed to fail: percentage of accounts with a valid owner, mean time to disable leavers, percentage of privileged accounts with unique named IDs, and quality of review sign-off.
To the committee, present it as: the process generated evidence of a problem rather than assurance - and that the fix is design plus monitoring, not another reminder email.
3. What are the insider-risk considerations in disabling the contractor account, and what would you preserve?
Read the worked answer
Considerations before acting:
- The contractor knows where claims data lives and may still hold copies. Abrupt, unannounced revocation can tip off someone if an investigation turns out to be warranted.
- There may be a live dispute, a legal hold, or a benign explanation such as a missed offboarding step.
- The contractor's manager also left in the same month - the natural person to question is gone, which hints that the offboarding gap may be systemic rather than individual.
- Claims data is personal and potentially sensitive; a possible unauthorised access event may trigger privacy assessment obligations regardless of intent.
Actions: do not contact the former contractor directly. Notify HR and legal counsel first and let them decide the communication. Coordinate the disablement so it is deliberate and its timing is documented.
Preserve: VPN authentication and session records; file-access audit logs for the claims share; directory and HR records showing contract end date; the wiki page history and edit trail; email or collaboration records only within policy and with legal approval. Look for indicators of misuse - off-hours access, bulk downloads, unusual volume, access from unexpected locations.
If misuse is indicated: convert to an incident, follow the IR plan, and let counsel determine notification. Maintain chain of custody for anything collected, and keep the matter out of team chat channels.