Greatest Practices for Constructing a Safe New-Rent Account Activation Workflow

Onboarding is a uniquely high-risk course of in that the IT division creates new identities and communicates with individuals who might not but be absolutely embedded within the group.

That creates alternatives for each errors and exploitation. Attackers might intercept credentials despatched to a private e-mail handle, whereas weak identification checks can enable the improper particular person to activate an account.

A safe workflow subsequently should defend how the primary credential is created, verify that the particular person enrolling is the meant worker and apply the identical normal of identification verification when assist is required.

Securely Getting ready and Delivering Entry Earlier than the First Day

The primary safety choice usually occurs earlier than the worker begins on the firm: who creates the preliminary password, and the way does it attain them?

A standard strategy is for IT to create a short lived password and ship it to the brand new rent by e-mail or SMS. It could be handy, however it additionally creates an pointless publicity level. The credential is understood to somebody aside from the worker and will stay written someplace lengthy after onboarding is full.

Greatest Practices for Safe Pre-Begin Account Activation

• Keep away from sending reusable credentials by means of peculiar communication channels: Don’t ship everlasting passwords or long-lived short-term credentials by means of channels like private e-mail or SMS, as these could be intercepted.
• Desire short-lived, single-use activation strategies: Use one-time activation hyperlinks, short-term tokens, or a safe onboarding portal. Tokens ought to expire rapidly and change into invalid as quickly as they’re used.
• Hold activation separate from identification proofing: Receiving an activation message solely proves that somebody can entry the account or system. It shouldn’t, by itself, be sufficient to ascertain that they’re the particular person the group employed.
• Keep away from predictable short-term passwords: Earlier analysis has proven that phrases like ‘Welcome’, ‘person’, and ‘temp’ generally seem in breached password datasets, so shouldn’t be used whilst short-term credentials.
• Use role-based entry for normal entitlements: Outline the methods and permissions staff ought to obtain based mostly on their position, division, or location quite than constructing entry manually for every new rent.

One of the best ways to mitigate the chance of first-day credential theft is to not share a credential in any respect. With Specops Safe Onboarding, IT sends the brand new rent a safe enrollment hyperlink to allow them to create their very own Lively Listing password earlier than their first day. IT by no means creates, sees or sends the credential, eradicating the interception threat that comes with e-mail and SMS handoffs.

Verifying Id and Activating Accounts on the First Day

An activation e-mail, short-term password, telephone quantity, or perhaps a firm laptop computer can all find yourself within the improper fingers. If the service desk lets somebody activate an account or enroll multi-factor authentication (MFA) with out first confirming who they’re, an attacker could possibly bind their very own system or credential to the worker’s account earlier than the professional person ever indicators in.

Greatest Practices for Id Verification and Activation

• Confirm identification earlier than granting full entry: Construct an specific identification test into first-time activation quite than assuming that possession of an activation hyperlink or short-term credential is sufficient.
• Enroll MFA as a part of the activation course of: Keep away from leaving new accounts in a password-only state for longer than crucial. MFA must be established earlier than the worker receives entry to delicate methods.
• Desire phishing-resistant authentication the place potential: Phishing-resistant MFA, passkeys, FIDO2 safety keys, and different strategies scale back the chance of credentials or authentication codes being captured throughout onboarding.
• Defend MFA enrollment itself: Registering a brand new issue is a security-sensitive motion. Require appropriate identification checks earlier than permitting MFA to be added to the account.
• Contemplate system belief in addition to person identification: If company laptops are shipped earlier than the beginning date, ensure system enrollment and first login are tied to the authorised person quite than treating possession of the system as adequate authorization.

Options like Specops Safe Onboarding add government-issued ID scanning and AI-driven biometric liveness detection to the onboarding course of. It checks that the doc is real and that the particular person presenting it’s bodily current, serving to defend in opposition to doc fraud, replay assaults and deepfake impersonation.

With assist for greater than 16,000 doc sorts throughout 254 nations, Specops Safe Onboarding can apply the identical verification normal throughout distant and worldwide hiring workflows.

Securing Exceptions, Restoration and Service Desk Assist

Password resets and account restoration can provide attackers entry to an account if strong verification processes aren’t in place. As such, the requester’s identification have to be verified earlier than the agent takes any high-risk motion.

Greatest Practices for Securing Ongoing Service Desk Assist

• Require sturdy verification earlier than resetting authentication strategies: Modifications to MFA elements and restoration particulars ought to require stronger checks than routine assist requests.
• Keep away from knowledge-based verification: NIST recommends in opposition to utilizing knowledge-based questions as a result of they are often socially engineered or discovered on-line.
• Don’t let urgency override verification: A brand new rent being unable to work is disruptive, however that ought to not change into a motive to bypass identification checks or safety controls.
• Limit who can carry out delicate restoration actions: Restrict the flexibility to reset MFA, change authentication strategies, or difficulty substitute activation credentials to appropriately licensed assist employees.
• Apply additional controls to high-risk accounts: Customers with elevated permissions, corresponding to directors, might warrant extra approval or verification earlier than restoration actions are accomplished.

Specops Safe Onboarding brings these controls collectively by constructing identification verification into each stage of the new-hire workflow.

Contact us at present to see how Specops may help you construct a safer account activation course of.