Topic

Offboarding and access revocation

The practice of removing accounts, tokens and keys when staff and contractors leave an organisation, and the identity lifecycle controls that govern it.

Current clusters

product1 publisher

An ex-employee's live OAuth token let strangers copy 170 CrowdSec repositories in nine minutes

TeamPCP's npm compromise of TanStack reached CrowdSec through a departed employee's laptop, and the company learned its private repositories had been copied only when the code surfaced on a dark web forum in September.

Publishers:devops.com

Reality

Evidence58
Adoption55
Hype gap+12
Incentives72
Confidence60

security7 publishers

Attacker copied 170 CrowdSec repositories with a departed employee's still-live GitHub token

CrowdSec kept a leaver's GitHub access open so he could finish some work, his laptop was hit by the TanStack npm compromise on May 11, and the repositories were copied on May 22 and posted to a forum on September 16.

Publishers:crowdsec.netgithub.cominfosecurity-magazine.comold.tanstack.comorca.securitysecurityweek.comthehackernews.com

Reality

Evidence42
Adoption58
Hype gap+22
Incentives72
Confidence55