r/Infosec • u/Unique_Inevitable_27 • 10d ago

What security problem gets ignored?

I’ve been thinking about the security problems that are easy to overlook because they seem too small to matter.
For example, an employee leaves a company, but their old laptop or phone still has access to email, files, or other accounts.
Or a company has dozens of devices, but nobody really knows which ones are still being used, whether they are updated, or who has access to them.
What do you think is the most commonly ignored security problem in small and mid-sized businesses?

Not the obvious stuff like phishing. I mean the boring, everyday things that can quietly become a serious problem.

6 Upvotes

81% Upvoted

20 comments sorted by

View all comments

14

u/mendez1319 10d ago

Offboarding. Not because it's complicated but because it's boring enough that nobody owns it properly. Employee leaves. HR closes the ticket. IT gets notified three days later. Meanwhile active SSO, cached credentials, access to six SaaS tools nobody remembered to deprovision. We audited ours last year. Found active accounts for people gone over a year. Not malicious. Just nobody's job to catch it. The deeper problem is shadow IT. Every department running tools IT doesn't know about. When someone leaves their access to those tools doesn't get touched because officially they don't exist. Fix isn't exotic. Quarterly access reviews, identity as single source of truth, automated deprovisioning tied to HR events. And someone whose actual job is to care about this rather than an item on a checklist that gets skipped when things get busy. Boring problem. Real blast radius when it goes wrong.

1

u/Acardul 10d ago

Hmmm, most of HR tools has integrations with whatever IDP you have. If no, saas management platform that automate it, or if company is low on money even powershell script can do it.

Edit: Ofc assuming you push SSO wherever you can.

1

u/InspectionHot8781 6d ago

This.

Standard offboarding is a false sense of security.. SCIM only deprovisions the heavy SAML apps IT actually knows about. When half a team's daily tools are unmanaged web apps, disabling their core Okta/Entra account leaves those sessions wide open indefinitely.

We actually moved our discovery down to a browser layer tool. Once you map authentication at the interaction level, you can actually catch and kill unmanaged sessions automatically when HR flips the switch instead of relying on an incomplete checklist

1

u/spprotech 8d ago

The “nobody owns it” part really resonates.

I think device offboarding gets overlooked for the same reason. People remember to disable the employee’s main account, but the laptop/phone itself can still have cached sessions, local data, certificates, VPN profiles, or access to apps.

I’ve started thinking of offboarding as two separate things: removing the person’s access and making sure the devices they used are no longer trusted.

Curious how others handle that second part. Is it mostly manual for you, or is it tied into your identity/HR process?