An interface that sends orders to our carrier stopped one night in March. The cause was a password change on an account belonging to an engineer who left this company four years ago and whose account we had deliberately kept alive, because several things depended on it and nobody knew which.
We went through the estate. Of the automated jobs we run, twenty three sign in as a named human being. Seven use my predecessor's account. Two use mine. One uses the account of a contractor who was here for seven months in 2021, and one uses a shared account created for a project that finished before I joined.
The consequences are not subtle once you look at them. The audit log records a person's name against everything the automation does, so when internal audit asked who had amended fourteen hundred prices overnight, the honest answer named a man who has not worked here since 2022. These accounts carry the full rights of the person they belonged to, which in my predecessor's case is everything, long after the work that needed those rights has been forgotten. They hold mailboxes and licences we pay for. Three had been exempted from our second factor so the scripts would keep working, which means the most powerful accounts in the estate were also the only ones permanently excused from the control we spent a year deploying.
Nobody chose this as a policy. Using a person's credentials is simply the fastest way to make something work on a Thursday afternoon, and at that moment nobody is thinking about the leaver process in four years' time.
Every job now runs as an identity that belongs to a machine, with a stated purpose, an owner who is a current employee, only the rights that job needs, and a rotation somebody has actually performed. The leaver process checks whether anything runs as the person leaving, which it had never done. Two supplier products cannot work this way, and each of those is now a written exception with a date and a conversation booked for the renewal.
It took six dull weeks. The estate can now tell the difference between a machine doing its job and somebody's account behaving strangely, which it genuinely could not before.
– Serguey Shinder
