The cost of not reaching IT project closure

Network World - All things, good and bad, eventually come to an end. Philosophers have told us this in many variations for at least three or four thousand years. In IT we seem to have exquisitely intricate plans for starting new things: projects, applications, users, policies. Yet we seem to always forget to plan for their eventual end: the closure of projects, the removal of applications, the retirement of servers and the departure of users. Why do we find it so hard to achieve closure?

The lack of closure can be costly. In IT projects it often means extra expense at the end of a project, long after any budget allocation is gone. Our total cost of ownership in IT rarely includes the cost of exit from a project -- whether the disposal cost of hardware, the migration of data to a new application, or the severing of a contractual relationship with a provider. When we lack an exit strategy we pay dearly. Having learned that the hard way, I have always added an "exit strategy" section to new projects and applications. Nowhere is that advice more important than security, where the lack of closure can leave gaping holes in your defenses.

One common example of a lack of closure can be found in most user directories. After conducting many security audits it no longer surprises me when a company discovers that the user directory (perhaps Active Directory or LDAP) contains 25% more entries than the number of employees. The most egregious example I have seen contained more than double the users than expected. Sometimes this "growth" occurs because of an obvious lack of policy and process for deleting users when they are laid off or resign. So companies keep adding new users but never delete the old ones.

Even if a process exists for deleting employee records after they are fired, there are dozens of other forms of closure that are missed: contractors who finish a short term job, employee retirement, short-term disability that turns into permanent leave, national guard service that is extended. I could go on for pages. Very often, the cases of employee departure that are missed are marginal ones where the paycheck continues or what was expected to be temporary leave becomes permanent. So the directories grow, phantom users long gone but never forgotten.

It's easy to see the lack of closure in other areas of security. Another great place to look is inside firewalls. Firewall access control lists suffer from growth that can be worse than user directories. Any auditor can provide dozens of stories about ACL lists with thousands of rules, each one further eroding that final "deny all", almost mockingly. Firewalls can become so encumbered with exceptions that the only possible solution is to wipe them clean and start over. Put them out of their misery with a "allow all", which does not affect their security but greatly improves their performance.

Managing closure in security is critically important. Our processes are usually unbalanced: finely tuned to add new users, ACLs, projects and applications as quickly and efficiently as the business needs dictate. We track key performance indicators and keep improving our response time. Yet, on the other end of the life cycle, our inability to find closure thwarts our security and erodes our defenses. Plan for closure, or the phantoms of the past become mountains of insecurity.