Security Vignettes

No. 17|Inventory & awareness

分享
17 / 43

A hundred seats, sixty people

A hundred seats paid for, and over thirty accounts nobody uses.

In an old teahouse, rows of small wooden stools sit almost all empty; a small robot raises a finger, counting.

(Illustrative scenario, not a real incident)

This eighty-person eyewear chainhad a collaboration tool coming up for renewal.

Finance asked IT to confirm:“How many seats should we buy this year?”

IT opened the admin consoleand sorted by “last sign-in.”

Paid seats: one hundred.Not signed in for over 60 days: more than thirty.

Some were employees who had left,some were contractors whose projects had ended,and a fewhad been “left open, just in case.”

The contract said:you can add seats mid-year, but you can't reduce them.

What you saw was money overpaid every year.What you didn't see were those thirty-odd accounts,unused, yet always open,especially the ones belonging to former staff and contractors.

Having an account is not the same as using it.A door nobody usesis the easiest one for someone else to push open.

Laozi said: “Know contentment and you will suffer no disgrace; know when to stop and you will meet no danger.”Know when enough is enough, and you won't be shamed;know when to stop, and you won't be in peril.

It's true of seats,and it's true of access.

What you can do today
  • Sort by last sign-in and flag idle accounts.
  • Disable accounts of former staff and contractors first.
  • Put the renewal date on the calendar and review ahead of time.
How did this make you feel?
分享