All things, good and bad, eventually come to an end. Philosophers have told us this in many variations for at least three or four thousand years. In IT we seem to have exquisitely intricate plans for starting new things: projects, applications, users, policies. Yet we seem to always forget to plan for their eventual end: the closure of projects, the removal of applications, the retirement of servers and the departure of users. Why do we find it so hard to achieve closure?

The lack of closure can be costly. In IT projects it often means extra expense at the end of a project, long after any budget allocation is gone. Our total cost of ownership in IT rarely includes the cost of exit from a project -- whether the disposal cost of hardware, the migration of data to a new application, or the severing of a contractual relationship with a provider. When we lack an exit strategy we pay dearly. Having learned that the hard way, I have always added an "exit strategy" section to new projects and applications. Nowhere is that advice more important than security, where the lack of closure can leave gaping holes in your defenses.

One common example of a lack of closure can be found in most user directories. After conducting many security audits it no longer surprises me when a company discovers that the user directory (perhaps Active Directory or LDAP) contains 25% more entries than the number of employees. The most egregious example I have seen contained more than double the users than expected. Sometimes this "growth" occurs because of an obvious lack of policy and process for deleting users when they are laid off or resign. So companies keep adding new users but never delete the old ones.

Even if a process exists for deleting employee records after they are fired, there are dozens of other forms of closure that are missed: contractors who finish a short term job, employee retirement, short-term disability that turns into permanent leave, national guard service that is extended. I could go on for pages. Very often, the cases of employee departure that are missed are marginal ones where the paycheck continues or what was expected to be temporary leave becomes permanent. So the directories grow, phantom users long gone but never forgotten.