An identity lifecycle is the sequence through which an account and its information are enrolled, propagated, used, updated, and terminated. Keeping each stage accurate preserves confidence in authentication and authorization decisions; neglected updates, revocation, or deactivation can leave stale credentials and attributes available for misuse. section 2.6.3 section 3.10
The lifecycle connects account administration with security controls:
- Enrollment establishes the account, binds attributes and credentials, and requires reliable identity proofing. section 2.6.3 section 3.10
- Propagation and use carry identity information into authentication and authorization decisions. section 3.10
- Updates keep attributes current; critical changes should be verified against the source of truth. section 2.6.3
- Termination removes or invalidates accounts when relationships end, limiting stale access. section 2.6.3 section 3.10
- Auditing and logging provide evidence that lifecycle controls operate as intended. section 2.6.3
Credential reset and account takeover
The 2020 Twitter breach shows how lifecycle governance affects trust: attackers persuaded help-desk staff to reset employee credentials, reached administrative tools, and hijacked prominent accounts. Stronger multifactor authentication, careful reset processes, and controls that reassess identity context could have reduced the risk. section 3.0
