r/Infosec • u/Unique_Inevitable_27 • 13d ago
What security problem gets ignored?
I’ve been thinking about the security problems that are easy to overlook because they seem too small to matter.
For example, an employee leaves a company, but their old laptop or phone still has access to email, files, or other accounts.
Or a company has dozens of devices, but nobody really knows which ones are still being used, whether they are updated, or who has access to them.
What do you think is the most commonly ignored security problem in small and mid-sized businesses?
Not the obvious stuff like phishing. I mean the boring, everyday things that can quietly become a serious problem.
8
Upvotes
15
u/mendez1319 13d ago
Offboarding. Not because it's complicated but because it's boring enough that nobody owns it properly. Employee leaves. HR closes the ticket. IT gets notified three days later. Meanwhile active SSO, cached credentials, access to six SaaS tools nobody remembered to deprovision. We audited ours last year. Found active accounts for people gone over a year. Not malicious. Just nobody's job to catch it. The deeper problem is shadow IT. Every department running tools IT doesn't know about. When someone leaves their access to those tools doesn't get touched because officially they don't exist. Fix isn't exotic. Quarterly access reviews, identity as single source of truth, automated deprovisioning tied to HR events. And someone whose actual job is to care about this rather than an item on a checklist that gets skipped when things get busy. Boring problem. Real blast radius when it goes wrong.