Every Identity Needs a Kill Switch

One organization I worked with had a simple emergency termination process. When HR had to walk someone out, they posted in a chat channel with the application and system administrators. Once HR posted that the person was gone, every administrator had one hour to remove that person's access.

It was clear. Everyone knew the trigger, who acted, and how fast. It also depended on every administrator seeing the post in time, and on that channel including every system the person could reach.

And it was built for one kind of identity: a person, with a manager and an HR record, who could be walked to the door while the paperwork caught up.

A service account cannot be walked out. Neither can a workload or an agent. When a credential leaks or an agent acts outside its bounds, there is no HR post to start the clock. Someone has to notice, someone has to decide, and someone has to have the authority and the means to stop it.

In my book I call this a kill switch, and every identity type needs one. An identity you can only stop on a schedule is one you do not fully control. Most environments find out which identities they cannot stop quickly in the middle of an incident.

AI shortens the time between a weak decision and its consequence. An agent acting outside its bounds does not wait for business hours. A kill switch is the half of access most programs build last: taking it away as fast as it was given.

A leader should be able to say, for every identity type, how it would be stopped today.

Name the trigger for each type. For people, it may be HR. For service accounts, workloads, and agents, decide who can pull the switch and write it down.

Give that person the authority in advance, so nobody is waiting for permission in the middle of the night.

Add one question to the emergency process: what did this person own? Their groups, the service accounts they were responsible for, and any agents they sponsored need a new owner the same day. Some may need to be stopped too.

Then run the drill at four o'clock on a Friday. Who gets paged? Who decides? How many minutes does it take? And does the revocation wait until Monday because nobody wanted to be the one to pull the plug before a long weekend?

If you are most of the identity team, the drill also answers a harder question: who acts when you are out?

That one-hour rule was clear about who acted and how fast. I would want that same clarity for every identity in the environment.

Related

• Series 3 Post 3: LinkedIn post
• Series 3 Post 4: LinkedIn post