Companies worldwide are trying to figure out new ways — and optimize already proven methods — of retaining employees. But did you know that employee retention can lead to security vulnerabilities? Fortunately, identity governance can help.

Employee Retention Can Make a Mess

When employees stay with a company for a long time, they change job roles, work on special projects and get promotions. This is great for the employees and their experience, but it can lead to problems with their user access. User access is added for new jobs, new roles, special projects and promotions, but in many cases, it is not taken away. When a user continues to aggregate this access, he or she can become a super-user of sorts and may end up with segregation of duties violations, otherwise known as a toxic combination of access.

A segregation of duties (SoD) violation is when a user has access to two entitlements that can create a conflict of interest. For example, a user may be able to create vendors and also pay vendors. This constitutes a violation because, theoretically, malicious users could create a vendor with their own bank account information and then subsequently pay that vendor.

This SoD violation would be a compliance issue as well as a serious security threat. There needs to be a set of checks and balances in place, along with a security solution that can monitor those checks and balances for accuracy.

Additionally, if an overentitled user’s account is compromised by an attacker, that account could become the keys to the kingdom. Not only would the attacker have access to real credentials, but credentials that have more access than they should. If those accounts aren’t being properly managed and governed, they could present a considerable threat to data security.

Finding an Identity Governance Solution

The right identity governance solution can help to solve this retention problem and prevent entitlements creep. It is critical to use a tool that can not only identify current segregation of duties violations, but also put processes in place to prevent them from arising in the future. When a user gets a new job role or promotion, their old entitlements should be re-evaluated and recertified.

Additionally, when users gain new entitlements for their new job role, they should be analyzed and compared with their past entitlements. If this new entitlement comprises an SoD violation with any of their old entitlements, the user should not be given access to it. It is critical to prioritize risks associated with user access in order to remain compliant and secure the organization. The right identity governance solution can make that easy.