Joiner-Mover-Leaver Awareness

What Is Joiner-Mover-Leaver Awareness?

Offboarding usually tracks what people hand back: the laptop, the badge, the HR record. The account has nothing to hand back, so it is the step that gets missed. You'll play an attacker who signs in to a leaver's still-active account with a password from an unrelated breach and exports the underwriting book. Then, as the analyst who owns access reviews, you'll find the account in the directory, disable it, watch the next export fail, and report why it stayed open.

What You'll Learn in Joiner-Mover-Leaver Awareness

• Explain why a leaver's account that stays enabled turns a reused, leaked password into working access
• Spot an orphaned account in a directory from its employment status, account state and last sign-in
• Disable a leaver's account and revoke its sessions, then confirm the credential no longer opens anything
• Explain why an offboarding checklist that tracks equipment can look complete while access is still live
• Report the root cause and propose controls, such as tying disablement to the leaver ticket and reviewing enabled accounts monthly

Joiner-Mover-Leaver Awareness — Training Steps

1. A List Somebody Sold Him

   Bob buys credential dumps. This one came out of a hobby forum breach last November and has nothing to do with Crestfield. He has filtered it down to the handful of people who signed up there with a work address.

2. One Name That Should Be Dead

   Five Crestfield addresses, five passwords, all in plain text because the forum stored them that way. One of the five belongs to somebody who left the company in March.

3. Try the Door

   Bob opens the underwriting workspace. He is not attacking it. He is going to sign in.

4. It Opens

   The password Marcus used on a hobby forum is the password he used at Crestfield. The account it belongs to was never disabled. No alert fires, because nothing unusual has happened: a valid user signed in with a valid password.

5. Take the Book

   Marcus worked in Underwriting, so his account still reaches the commercial book: policyholders, premiums, sums insured, claims history.

6. Four Thousand Policies

   The export runs under Marcus's name. In every log Crestfield keeps, this is Marcus doing his job. Bob leaves the tab open and does not come back for a while.

7. Where Did This Go Wrong

8. A Question From Security

   The underwriting book has turned up in a competitor's renewal quotes. Security traced the export and wants to understand the account that ran it.

9. Three Things Happened, One Did Not

   Everything visible was done. The laptop, the badge and the HR record were all handled the same week. The only step with no physical object attached to it is the one that was missed.

10. Open the Directory

    Alice opens the IAM portal from the link in the security email.