User Management and Permissions
Most security incidents don't start with a sophisticated exploit — they start with an over-privileged account or one that should have been disabled months ago. We help set up access control that's both practical to manage and tight enough to matter.
1. Access Policy Design
We define who should have access to what, based on role and actual need, rather than defaulting to broad access because it's easier to set up.
- Least privilege by default: access starts scoped to what a role actually needs, with broader access granted deliberately, not by default.
- Data sensitivity classification: identifying which systems and data need the tightest controls, so effort goes where the risk actually is.
- Documented policy: a written access policy that says who approves what, so decisions aren't made ad hoc and differently each time.
- Segregation of duties: making sure no single account can both request and approve sensitive changes, particularly around finance and production access.
2. Account Provisioning and Deprovisioning
We set up a clear process for creating accounts when someone joins and — just as important — for revoking access promptly when someone leaves or changes roles.
- Standardized onboarding: new accounts provisioned with the right role's access from day one, not copied from a random existing employee "close enough" to the new hire.
- Prompt offboarding: access revoked the moment someone leaves — a same-day checklist item, not something that happens whenever HR gets around to notifying IT.
- Role-change handling: access adjusted when someone changes teams, so old permissions don't just quietly stack on top of new ones.
- Centralized identity where possible: single sign-on so deprovisioning one account actually cuts off access everywhere, instead of chasing a dozen separate logins.
3. Role-Based Access Control (RBAC)
Instead of managing permissions per person, we structure access around roles, so granting or adjusting access stays consistent and auditable as your team grows.
- Role definitions: access grouped into roles that map to actual job functions, instead of one-off permissions per individual.
- Consistent grants: two people in the same role end up with the same access, not slightly different permissions because they were set up months apart.
- Auditable structure: answering "who can access X" becomes a lookup, not a manual investigation across a dozen systems.
- Scales with the team: onboarding the tenth person into a role takes the same five minutes as the first.
4. Multi-Factor Authentication
We roll out MFA across critical systems and admin accounts, closing off the most common path attackers use once a password leaks.
- Priority rollout: admin accounts, VPN access, and anything internet-facing get MFA first — the accounts that matter most if compromised.
- Practical enforcement: MFA required without creating so much friction that people look for workarounds.
- Backup access paths: recovery codes and break-glass procedures planned in advance, so a lost phone doesn't lock someone out during an incident.
- Phishing-resistant options: hardware keys or authenticator apps over SMS codes where the risk profile calls for it.
5. Periodic Access Reviews
Access tends to accumulate over time. We run periodic reviews to catch stale accounts, unused permissions, and access grants that no longer match someone's current role.
- Scheduled reviews: access audited on a set cadence — quarterly for sensitive systems — instead of only after something goes wrong.
- Stale account detection: flagging accounts with no recent activity, contractor access past its end date, or permissions nobody can explain anymore.
- Manager sign-off: team leads confirming their reports' access still matches their actual role, since they know that better than IT does.
- Audit trail: a record of what was reviewed and when, useful for both security posture and compliance requirements.
Contact us for an access control review, or to set up user management from scratch on a new system.