Signs it is time to revisit access control

This is one of those topics that looks small until it costs you something. A few signals that access control is due some attention.

The realistic threat for most small businesses is automated and opportunistic, not targeted. It is worth deciding this deliberately rather than inheriting whatever the last person set up.

The signals

• Nobody can say when it was last reviewed
• The answer depends on who you ask
• Give the least access that lets someone do their job
• Review who has access when people change roles

How we handle it

Shared logins destroy accountability. The reasoning matters more than the rule, because the rule has exceptions. If it only works because one person remembers to do something, it does not work yet.

How to tell if yours is fine

Security is a maintenance habit rather than a purchase, which is why it drifts. Three things worth confirming about access control before you move on:

• Someone can say what the current setup is without going to look
• Review who has access when people change roles — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If any of that sounds like a description of your current setup, it is fixable.