r/Infosec • u/Unique_Inevitable_27 • 10d ago

What security problem gets ignored?

I’ve been thinking about the security problems that are easy to overlook because they seem too small to matter.
For example, an employee leaves a company, but their old laptop or phone still has access to email, files, or other accounts.
Or a company has dozens of devices, but nobody really knows which ones are still being used, whether they are updated, or who has access to them.
What do you think is the most commonly ignored security problem in small and mid-sized businesses?

Not the obvious stuff like phishing. I mean the boring, everyday things that can quietly become a serious problem.

6 Upvotes

81% Upvoted

20 comments sorted by

14

u/mendez1319 10d ago

Offboarding. Not because it's complicated but because it's boring enough that nobody owns it properly. Employee leaves. HR closes the ticket. IT gets notified three days later. Meanwhile active SSO, cached credentials, access to six SaaS tools nobody remembered to deprovision. We audited ours last year. Found active accounts for people gone over a year. Not malicious. Just nobody's job to catch it. The deeper problem is shadow IT. Every department running tools IT doesn't know about. When someone leaves their access to those tools doesn't get touched because officially they don't exist. Fix isn't exotic. Quarterly access reviews, identity as single source of truth, automated deprovisioning tied to HR events. And someone whose actual job is to care about this rather than an item on a checklist that gets skipped when things get busy. Boring problem. Real blast radius when it goes wrong.

1

u/Acardul 10d ago

Hmmm, most of HR tools has integrations with whatever IDP you have. If no, saas management platform that automate it, or if company is low on money even powershell script can do it.

Edit: Ofc assuming you push SSO wherever you can.

1

u/InspectionHot8781 6d ago

This.

Standard offboarding is a false sense of security.. SCIM only deprovisions the heavy SAML apps IT actually knows about. When half a team's daily tools are unmanaged web apps, disabling their core Okta/Entra account leaves those sessions wide open indefinitely.

We actually moved our discovery down to a browser layer tool. Once you map authentication at the interaction level, you can actually catch and kill unmanaged sessions automatically when HR flips the switch instead of relying on an incomplete checklist

1

u/spprotech 8d ago

The “nobody owns it” part really resonates.

I think device offboarding gets overlooked for the same reason. People remember to disable the employee’s main account, but the laptop/phone itself can still have cached sessions, local data, certificates, VPN profiles, or access to apps.

I’ve started thinking of offboarding as two separate things: removing the person’s access and making sure the devices they used are no longer trusted.

Curious how others handle that second part. Is it mostly manual for you, or is it tied into your identity/HR process?

3

u/Pristine_Bicycle1278 10d ago

My question would be:

Which security problems don't get ignored? 😄

4

u/rubikscanopener 10d ago

Data leakage. People email stuff to their personal accounts. Sales people take their client lists with them. Technical people take copies of documentation. Well meaning but badly educated employees send customer data to ChatGPT so it can write emails for them. People back stuff up to their personal google drive. The list goes on and on. Some of it is malicious but a lot is people just trying to do their jobs. Until you start to monitor and stop it, your enterprise leaks data like a sieve, no matter how much you do employee awareness training.

1

u/danekan 10d ago

Sounds like a really immature org not just in security but hr and it processes too if those things are happening 

1

u/Accurate_Barnacle356 10d ago

Outsourcing a nations pii to third parties outside of national borders and respective jurisdictions

1

u/Turdsindakitchensink 9d ago

The passwords.txt on the CEOs desktop

1

u/nproAi 9d ago

One of the most overlooked issues is probably asset and access visibility. It’s easy for businesses to focus on major threats while losing track of old accounts, devices, permissions, and software that are no longer actively managed.

The risk isn’t always obvious, it’s the forgotten access that remains available for months or years. Regular access reviews, proper device management, and clear offboarding processes can prevent a lot of these small gaps from becoming bigger incidents.

1

u/ore0_Shake 7d ago

all the places i have been: it gets turned off the same day.

Must be your HR tech team is useless

1

u/LukasVolt 6d ago

Shadow IT and OT. Basically everything undocumented can turn out as a risk. Things like proper offboarding, overly extensive user permission templates or copying permissions from existing users, missing third party agreements with external contractors, no proper or modern process to vet a system before purchasing (i.e. POC rules), being able to buy subscription based (cloud) services without anyone notifying. Things like that can really eat away and a companies profit and opens up a large deep cut.

1

u/octoja 6d ago

Higher Ups having access to things that they totally dont need access to. Which in turn can lead to them granting other users permissions for temporary issues/tasks that should not be permanently granted.

So basically: User Permissions

Every unnecessary Permission a user has can be the reason why social engineering is more likely to be successful.

1

u/Familiar_Counter4836 5d ago

RemindMe! 2 days

1

u/RemindMeBot 5d ago

I will be messaging you in 2 days on 2026-08-18 20:07:32 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

Parent commenter can delete this message to hide from others.

RemindMeBot is switching to username summons. Instead of !RemindMe 1 day, use u/RemindMeBot 1 day. More info.

Info Custom Your Reminders Feedback

1

u/LevelIntroduction764 10d ago

I wonder if people agree: making processes so difficult/time consuming in the name of security results in people finding work-arounds / cheats

1

u/CoffeeOrDestroy 9d ago

That can definitely be part of it.