Topic starter
09/12/2025 2:57 pm
TL;DR: A terminated credit union employee allegedly deleted 21.3GB across 20,000 files and nearly 3,500 directories two days after being fired, according to Britive, after retained cloud access left a short but sufficient window for destructive activity. Off-boarding that relies on delayed revocation instead of immediate privilege removal turns resignation and termination into an identity control problem.
Editorial analysis by NHI Mgmt Group, based on content published by Britive: “Off-boarding Matters: How to Protect Your Company and Customers from Employees with Bad Intentions”.
Key questions
Q: What breaks when offboarding does not remove cloud access promptly?
A: When offboarding does not remove cloud access promptly, former employees or contractors may retain a direct path into sensitive resources and data.
Q: Why do standing cloud privileges increase insider risk after termination?
A: Standing privileges keep access alive by default, so an ex-employee does not need to obtain anything new to act after separation.
Q: How do security teams know whether offboarding is actually working?
A: Security teams should measure completion, not process start.
Practitioner guidance
- Compress termination-to-revocation workflows Trigger access removal from cloud file stores, consoles, and admin paths as part of the separation event, not as a later ticket in the queue.
- Eliminate standing privileges from user access Replace always-on permissions with just-in-time access so former employees do not retain dormant access paths that survive off-boarding.
- Validate cloud off-boarding coverage Check that every application, storage layer, and federated identity connector is included in the revocation workflow and session kill process.
Bottom line: The article shows how a terminated employee can still do damage when cloud access survives separation long enough to be used.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago 2 times by Abdelrahman
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:25 pm
Off-boarding delay is a governance failure, not an administrative inconvenience. The article shows that the real risk is the time between separation and revocation, when a former employee can still act inside the environment. That is a joiner-mover-leaver weakness in cloud identity governance, not merely a HR process miss. Practitioners should treat every minute of residual access as exposure.
A question worth separating out:
Q: When should organisations replace standing privilege with just-in-time access?
A: Organisations should replace standing privilege with just-in-time access whenever elevated access is not required continuously. JIT reduces the time window in which credentials can be abused, especially for admin tasks, break-glass use, and sensitive automation. It works best when paired with approval, expiry, and logging so temporary access does not become another form of standing privilege.
👉 Read our full editorial: Off-boarding gaps in cloud access create identity risk