A practical checklist for access control

Every audit we run turns up some version of this. Run through this the next time access control comes up.

The cheapest security work is the boring kind done on a schedule. The version that survives contact with a real deadline is the simple one.

The checklist

• Give the least access that lets someone do their job
• Review who has access when people change roles
• Shared logins destroy accountability
• Someone is named as the owner
• There is a date to review it again

What is actually at stake

Give the least access that lets someone do their job. Small and consistent beats large and occasional here. If it only works because one person remembers to do something, it does not work yet.

In practice

Security is a maintenance habit rather than a purchase, which is why it drifts. Three things worth confirming about access control before you move on:

• Someone can say what the current setup is without going to look
• Give the least access that lets someone do their job — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If you want a second opinion on how yours is set up, ask.