Sixty dormant accounts and a shared admin login
During an ISO 27001 audit, a platform ops team at a healthcare insurer discovers 60 active OutSystems users who left the company between 3 and 18 months ago. All 60 have the Administrator role in LifeTime because the provisioning process grants it by default. Five operations engineers share a single local account named opsadmin with a password stored in a team wiki; the account is used for emergency changes and has never been rotated. Production database access uses one SQL login embedded in a scheduled job. The audit report gives 30 days to remediate. The company uses Active Directory and has an enterprise IdP that supports SAML. There are 240 active platform users. Propose a remediation plan with sequencing and evidence.
1. Design the identity and access remediation for the 30-day window.
Read the worked answer
Sequence by risk. Days 1–3: disable all 60 leaver accounts and revoke their sessions; rotate the opsadmin password and remove it from the wiki; change the SQL job credential. Days 4–10: inventory every account and role, map each to a current owner and job function, and remove Administrator from anyone who does not need platform-wide change rights. Days 11–20: integrate LifeTime with the enterprise IdP via SAML and Active Directory groups; define three role bundles (platform admin, environment operator, read-only auditor) and assign by group, not individually. Days 21–25: introduce a break-glass account with a managed secret, checked out per use and rotated after each use. Days 26–30: run an access review with business owners signing off, and produce the evidence pack. The reasoning: leavers and shared credentials are immediate audit failures; SSO and role bundles are the durable fix, but they take longer than account cleanup.
2. What evidence would you present to the auditor?
Read the worked answer
Provide a reconciliation report from the IdP showing all 60 leavers disabled, with timestamps, and an export of the current active user list matching HR. Provide the role matrix and signed access-review records for all 240 users. Show the change tickets for removing default Administrator rights and for rotating the shared and database credentials. Supply IdP authentication logs proving the five engineers now use named accounts, and a statement that opsadmin is disabled. For the SQL job, show the new service account owner, least-privilege grants, and secret storage location. Include the break-glass procedure and a test record showing checkout and rotation. Finally, provide the LifeTime audit log export covering administrative actions during the remediation window. The reasoning: auditors need evidence of both removal and prevention, tied to named owners and dates, not a narrative.
3. How do you prevent recurrence?
Read the worked answer
Build joiner/mover/leaver automation from HR to the IdP, with LifeTime group membership driven by role, not by default. Ban shared accounts; require named accounts for all humans and managed service accounts for jobs, with secrets in a vault. Run quarterly access reviews with automated reminders and escalate non-responses. Add monitoring alerts for dormant accounts, privilege escalation, and use of break-glass credentials. Review the role model whenever a new environment or team is added. Report two metrics to leadership: time to revoke access after termination (target under 24 hours) and percentage of users with administrative rights (target below 5%). Test the leaver process quarterly by creating a dummy account and confirming it is disabled automatically. The reasoning: the audit finding was a process failure, not a one-time cleanup; controls must catch the next leaver before the next audit.