Removed: nothing. The applications were recorded as retired; their hardware and user accounts stayed on the network.
Outcome: 10 of the 13 retired business applications the auditors reviewed — 77 percent — had incomplete system documentation and 93 components, “such as hardware and user accounts, that were still active on the network.” A later sweep found active components for all 4,336 applications sitting in retirement status.
The Postal Service’s own security office found it: sampling 125 of the 4,336, every one still had active components, including “active user accounts, which an attacker could exploit to gain direct access to the application server”. By April 2021 it had identified active components for the remaining 4,211 applications; the group responsible for remediation “has not developed a plan to review and remove the identified retired application components.”
The organisation was not ignoring the problem: it wrote a new retirement process in January 2021 that the auditors agreed aligned with best practice, but with no control on the dates. Of the two applications then in the retirement phase, one was 31 days past its due date with about 57 percent of its tasks incomplete. The auditors wanted a formal plan with target dates.
Sources: