Part 2: Human Workloads (The Meatbags)
Chapter 3: Onboarding, Offboarding, and the Chaos In Between
If you want to know how strong a company’s actual security posture is, do not ask to see their firewall rules. Ask to see what happens on an employee's first day (Joiner) and their last day (Leaver).
Human identities are fundamentally messy. Humans get promoted, demoted, change departments, go on sabbatical, and occasionally quit in a blaze of glory. In the IAM world, this lifecycle is called JML: Joiner, Mover, Leaver. When this administrative process breaks down, your billion-dollar network security architecture falls apart from the inside out.
Let's look at the three phases of human identity and how our 5 Pillars apply to keeping the chaos under control.
1. The Joiner Phase (Day 1 Delays)
We have all experienced a bad Joiner process. You show up on Monday morning, eager to work, and by Thursday afternoon you still do not have access to your email, the VPN, or the source code repository.
Why does this happen? Because HR and IT speak two entirely different languages. HR knows you as "Employee #4592, Marketing Manager." The Network team only knows that a specific laptop MAC address is trying to hit the internal file server on Port 443, and they need to know if it is allowed.
- Process (The Goal): Automated provisioning. When HR enters a new hire into their human resources system (like Workday or BambooHR), it should trigger a script that automatically creates an Active Directory (AD) account, assigns an email, and provisions a basic VPN profile.
- Technology (The Bridge): Identity Governance and Administration (IGA) tools act as the translation layer between HR and the network.
- Control (RBAC): To automate this access safely, we rely on Role-Based Access Control (RBAC). Instead of manually assigning 50 different micro-permissions to Alice, you assign Alice to the role of "Marketing Manager." The role itself acts as a container for the permissions.
Interactive Simulator: Role-Based Access Control (RBAC) Builder
Test how assigning roles dynamically updates effective permissions and triggers Separation of Duties (SoD) warnings:
RBAC Matrix Simulator
Assign roles to test identity privileges and detect toxic Separation of Duties (SoD) violations.
Role Assignment
Select roles assigned to user 'Bob':
2. The Mover Phase (The Danger of "Privilege Creep")
This is, without a doubt, the most dangerous phase for network security.
Imagine Bob is hired as a Junior Developer. Two years later, he transfers to IT Support. Two years after that, he is promoted to Network Administrator.
In a broken JML process, when Bob moves to a new department, IT simply adds his new permissions without bothering to remove his old ones. Over six years, Bob accumulates the keys to the entire kingdom. He can write production code, approve his own IT tickets, and change the core firewall routing rules. This phenomenon is called Privilege Creep.
- Impact: If Bob accidentally clicks a phishing link, the attacker doesn't just get a Network Admin account; they get a God-mode account that spans three different departments.
- Control (Continuous Certification): The defense against Privilege Creep is rigorous access reviews.
- People: Every 90 days, the IAM system must email Bob’s current manager with a list of Bob's permissions. The manager must verify if Bob still needs them. If they ignore the email, the access is automatically shut off.
Visual Logic: Privilege Creep vs. Zero Trust
3. The Leaver Phase (The Orphaned Account Problem)
When someone quits or is fired, HR knows immediately. But if the IAM system is not tied directly to HR, the network team might not find out for weeks.
An active IT account belonging to someone who no longer works at the company is called an Orphaned Account. It is a sitting duck for hackers. Because the former employee is gone, nobody is checking the account for weird login locations or unexpected MFA prompts.
- Control (Automated Offboarding): The exact second HR marks an employee as "Terminated" in their system, the IAM gateway must immediately kill the active VPN session, revoke all Single Sign-On (SSO) tokens, and scramble the Active Directory password.
- Impact: A disgruntled employee who retains network access after being fired can delete servers, steal customer data, or deploy ransomware. The blast radius here is catastrophic, and the company is entirely liable.
Consultant's Corner: Solving the "Rubber Stamp" Problem
When you implement Access Reviews (the primary control for the Mover phase), you will immediately run into a human problem. Managers are busy. If you send a department head a static Excel spreadsheet containing 5,000 rows of technical Active Directory groups, they will not read it. They will just rubber-stamp the audit by clicking "Approve All," defeating the entire purpose of the security control.
How to fix it: Elevate the UI/UX.
Do not rely on legacy spreadsheets. As an IAM architect, you need to present data in a way that is human-readable and contextual. By building interactive, responsive Single Page Applications—utilizing modern frontend tools like React, Tailwind CSS, and charting libraries—you can transform raw data into a visual dashboard.
Instead of asking a manager: "Does Alice need AD_Group_SVR_4492_RW?"
Your dashboard translates it visually: "Does Alice still need write access to the Q3 Financial Reports folder?"
When you make the Technology frictionless and visually clear, the People will actually follow the Process.