Username (Email) ReUse

Lifecycle & Governance
1

Good Day all.

We have what seems to be a unique issue. We are preparing to migrate to IdentityNow.  Our issue is that historically, we do not reuse any usernames or email addresses.  We are being informed that this is a very difficult request.  A couple of questions:

  1. What do other enterprises do with username/email address reuse?  If anyone can add their $.02, we would appreciate it.
  2. Has any community member ever address this issue with not reusing the values?

We do understand that we can change business practice, but when one finds that the ISC2 quotes the ISO 27001 where the reuse of these are advised against, to stop identity theft and unauthorized access.

Any thoughts about this?  I did not easily find previous discussions.

Thanks, Dale

2

Not reusing things isn’t impossible there’s a few schools of thought here. and depending on what your retention requirements are from legal / regulatory agencies, you can do almost any of them.

In the most basic terms, why are you retaining the emails/usernames, and are you retaining the mailboxes?

If you don’t have to retain them for legal purposes, after a user leaves, you can hold onto the mailbox for however long you determine (I’d say 60 days max) then purge the data and reuse the email or username if it fits your convention. no worries. this is what we do.

If you DO need to retain them, then are you required to retain the mailboxes, or the mailbox and object it came from? if you don’t need the mailbox and the object, keep what you need and dump the rest. if it’s just the mailbox. easy, you backup the mailbox and then purge the objects for reuse. If you need the object, then your hands are kind of tied BUT, you can work with that. If you need to keep the object you can use the attribute value to ensure you don’t make a dupe and make a new iteration.

This is a good opportunity to change. what ISC2 is really getting at, is that it can be easy to figure out what someone’s email or username is if you use names in them. and I think most people are guilty of it.

Fear not. I have your solution to this.

What needs to be done going forward is to change what you actually do for username and primary SMTP.  Since randomization is the best but hard to ensure you’re not going to run into randomizing the same thing twice, plus most people don’t remember them. you can make something that SEEMS random, but your employees can remember.

Some things I have toyed with are the First letter of the first name + first letter of the last name + last 4 digits of the employee number + 2 flex characters, which can be randomized or run through a list or hard set every year or so to something new.

this way you can give everyone a unique username MF1234AX and primary SMTP:: MF1234AX@domain.com  then you can set any additional alias you want that way you can give john.smith@domain.com out again if another user with the same name comes in.