Attacks on identity lifecycle
Techniques that target joiner, mover, and leaver: help desk resets granted on weak proof, entitlements that accumulate across role changes, and accounts nobody remembered to disable.
Why this control fails
Lifecycle failures do not need a technical exploit, they need a process gap. A help desk that resets a password or an MFA factor on a phone call and a plausible answer is a social engineering target, not a security control. Movers keep every entitlement from their old role because deprovisioning on transfer is rarer than deprovisioning on exit, so tenure alone becomes a privilege escalation path. Leavers whose accounts are not disabled the day they depart, especially in systems outside the SSO umbrella such as VPN appliances or SaaS admin consoles, become orphaned accounts: active, unowned, and unmonitored until an auditor or an attacker finds them first.
What security people should do
- Require a second, out-of-band verification step before any help desk password or MFA reset, and log every reset against the requester.
- Trigger an access recertification on every role change, not just on hire and termination.
- Reconcile accounts in every connected system against an authoritative HR source on a fixed schedule, not only during audits.
- Automate deprovisioning for termination and make manual override the exception that requires a ticket, not the default path.
Techniques in this category
A phone call to IT support, not a login attempt, is the actual attack. The target's strong password and MFA enrollment never come into play, because the attacker gets a human to reset both.
An employee who changes roles keeps every entitlement from every prior role, because provisioning adds access automatically and nothing removes the old access automatically.
An account left active after its owner departed or its purpose ended draws no attention from anyone, because no one owns it, no one expects a login from it, and no one is watching for one.