Access Controls Review: Unauthorized Payroll Entry
Overview
Investigated an unauthorized payroll entry posted under an administrator account.
Key findings
- The event log tied the entry to the IP address of a legal contractor whose access had ended almost four years earlier, but whose account was never deactivated.
- Every user in the directory, including part-time, seasonal and contract staff, held broader access than their role required.
- Recommended authorization and authentication fixes, including timely account deprovisioning and least-privilege access.
The deliverable
