When access control is worth the effort

It is rarely the thing that gets a project approved, and often the thing that decides how it goes. Access control is not free, and pretending otherwise leads to bad decisions.

The cheapest security work is the boring kind done on a schedule. Assume whoever inherits this will have half your context and none of your patience.

When it is worth it

Give the least access that lets someone do their job. Getting it slightly wrong is survivable. Ignoring it entirely is not. Write the reasoning down alongside the decision, because the reasoning is what changes first.

When it is not

If nothing downstream depends on it and nobody is complaining, it can wait. Getting it slightly wrong is survivable. Ignoring it entirely is not.

How to decide

Shared logins destroy accountability. The cost of getting this wrong is rarely visible on the day it happens. Write the reasoning down alongside the decision, because the reasoning is what changes first.

The short version

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about access control before you move on:

• Someone can say what the current setup is without going to look
• Give the least access that lets someone do their job — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Pick the one that would hurt most if it failed, and start there.