Failing to manage identities
Before we move on to Identity Management (IdM), let's look at a few examples of failing to manage identities:
- A new employee has joined the organization. Since we do not have a documented and automated IdM workflow, the employee's permissions were copied from a system administrator's profile. The new employee was not aware of which sites they should browse on the internet, and, as result, they were infected by ransomware. This, in turn, infected the sales database, which was encrypted, and caused downtime for the sales division.
- An employee was able to create an easy-to-guess password (because a complex password policy was not enforced at the organization level), and, as a result, a hacker was able to guess the employee's password and gain access to a confidential financial report.
- An employee has changed their role in the organization, from IT to the development team, and we forgot to update their privileges on the production...
