The door is shut, the window is open
The single sign-on door was shut, but the window beside it was still open.
(Illustrative scenario, not a real incident)
At this fifty-person software company,email, documents and the code platformwere all connected to single sign-on.IT felt at ease:when someone leaves, one click disables everything.
On the day Zhiwei, the sales manager, left,IT made that one click.
But Zhiwei was also using a quoting systemon a plan too cheap to include single sign-on,protected only by a username and password.There was a survey tool, too,and a business-card app he had authorized with his company account.
Two months later, the quoting system's logsshowed a login from Zhiwei's account.
Who was it? Why?Nobody could say.Because which windows had been openedonly Zhiwei himself remembered.
I used to think that once the front door was shut,the house was safe.Later I learnedthat what really keeps you up at night is those few windows.
Zhuangzi said:“You can't talk about the ocean with a frog in a well;he is bound by the space he lives in.”The frog cannot see the sea,not because it is foolish, but because all it can see is the mouth of the well.
What we can see,too, is often just the circle that single sign-on draws.
Don't let the offboarding checklist say only “disable identity account.” List every tool that isn't on single sign-on and every third-party authorization, one by one, and keep a record once each is closed.