Ghost Credentials, Real Risk: Making Access Decommissioning an Auditable Routine
Every zero-trust programme eventually meets the same awkward discovery: the estate contains more access than anyone can quietly account for. A VPN concentrator that left the architecture diagram in 2023 but still answers on 443. A service account created for a migration and never retired, still holding read rights across a directory. A firewall rule that opened a management range to part of the corporate WAN "temporarily" and has since outlived two heads of infrastructure.
None of these appear in a maturity assessment. All of them appear in a post-incident timeline.
The liability that hides in plain sight
Zero-trust architecture is usually described in terms of what gets added: identity providers, policy engines, segmentation, continuous verification. The discipline that rarely gets budget is subtraction. Yet the residual access estate is where entropy accumulates fastest, because nothing in the organisation is rewarded for noticing it.
For UK organisations the assurance context sharpens the point. The NCSC's Cyber Assessment Framework asks, in effect, whether you know what is connected and who can reach it. UK GDPR principles of minimisation and storage limitation apply to credentials as much as to personal data. Procurement questionnaires and supplier attestations increasingly ask for evidence of joiners-mover-leaver rigour, not just policy existence. A dormant administrator account is therefore not merely an operational untidiness: it is an un-evidenced control gap sitting inside a regime that expects you to know your own estate.
The commercial dividend is real too. Retired VPN concentrators fall out of support contracts. Unused service accounts stop consuming licence entitlements. Audit cycles shorten when the inventory stops generating exceptions that must be explained rather than fixed.
Why retirement stalls
Four forces hold stale access in place, and only one of them is technical.
- No named owner. Access created by a project that has since disbanded belongs, in practice, to nobody.
- Asymmetric blame. No one has ever been disciplined for leaving a firewall rule in place. People have been disciplined for an outage.
- Weak signals. Many systems log authentication success, not the absence of it. A credential nobody uses looks identical to a credential nobody has needed yet.
- Audit focus on presence, not absence. Controls are tested for existence. Fewer access paths is not obviously a stronger control until you frame it that way.
Naming these forces matters, because a decommissioning programme that ignores them becomes a series of individual escalations rather than a repeatable process.
A prioritisation model you can defend
Score each candidate on four factors from 1 to 5 and multiply them. The product gives a defensible ordering without pretending to be precise.
| Factor | 1 | 5 |
|---|---|---|
| Exposure | Reachable only from a hardened jump host | Internet-facing or reachable from any user segment |
| Privilege | Read-only, narrow scope | Administrative or cross-domain |
| Sensitivity | Public or low-impact data | Regulated, financial or safety-relevant systems |
| Staleness | Used within the last 30 days | No recorded use in 12 months, no owner response |
Treat scores of 300 and above as a 14-day retirement, 120 to 299 as within the quarter, and everything below as part of a rolling clean-up. Publish the model, not just the outcomes: auditors accept judgement when the method is written down and consistently applied.
The four-gate retirement train
Gate one — discover and attribute. Pull the full inventory from identity, network and configuration sources, then attempt attribution. Anything unattributed goes on the risk register with a named accountable executive rather than a team inbox.
Gate two — notify and constrain. Announce the intended retirement, then reduce rather than revoke. Shorten session lifetimes, remove standing privilege, restrict source ranges, and monitor for attempts. A silent constraint window of 14 to 30 days converts opinion into evidence.
Gate three — revoke. Remove the credential, rule or profile through change control, with a timestamped record and a named approver. Where a business owner objects at this stage, the objection must come with a remediation date and an interim control.
Gate four — record. Capture the post-removal check: no authentication attempts for 30 days, no tickets raised, no dependency alarms. This is the artefact that turns a clean-up into an assurance statement.
Scripts for the conversation nobody wants
To an application owner: "We are not asking whether the account is still needed. We are asking what breaks in the next 30 days if it is disabled, and who would notice. If the answer is 'nothing', it retires on the 14th."
To an auditor: "Here is the inventory extract, the risk score, the notification trail, the constraint monitoring log, the change record and the 30-day post-removal check. The estate shrank by 214 access paths this quarter, and we can show each one."
To a senior sponsor: "Every retired path is a route an attacker no longer has to be blocked from. It also removes a standing exception from the next audit cycle."
Evidence that survives scrutiny
Six artefacts carry most of the weight: the scored inventory extract, the decision record with accountable owner, the notification and objection trail, the constraint-period monitoring output, the revocation change record, and the post-removal assurance check. Store them alongside the change, not in a separate spreadsheet that drifts.
The dividend is not the tidy diagram. It is a smaller blast radius, a shorter audit conversation and an organisation that can state, with evidence, what it has stopped trusting.
