ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

  • ID: ME021
  • Created: 19th June 2024
  • Updated: 19th June 2024
  • Contributor: The ITM Team

Unrevoked Access

The subject has left the organization but still has access to services or data that is reserved for employees.

Subsections

ID Name Description
ME021.004API Keys

API keys that were available to the subject during employment are not revoked and can still be used.

ME021.006Multi-Factor Authentication

MFA tokens or hardware devices (such as physical security keys) issued to the subject during employment are not deactivated and can still be utilized.

ME021.003Physical Access Credentials

Physical security credentials, such as an ID card or physical keys, that were available to the subject during employment are not revoked and can still be used.

ME021.005SSH Keys

SSH keys that were available to the subject during employment are not revoked and can still be used.

ME021.001User Account Credentials

User credentials that were available to the subject during employment are not revoked and can still be used.

ME021.002Web Service Credentials

Web credentials that were available to the subject during employment are not revoked and can still be used.

Prevention

ID Name Description
PV023Access Reviews

Routine reviews of user accounts and their associated privileges and permissions should be conducted to identify overly-permissive accounts, or accounts that are no longer required to be active.

PV024Employee Off-boarding Process

When an employee leaves the organization, a formal process should be followed to ensure all equipment is returned, and any associated accounts or access is revoked.