Access Rights How Should You Manage?

Access rights can lead to all forms of issues if they are incorrectly managed in a business.

Access rights

Access to systems whether physical or logical will often have permissions and access given to a user. These should be managed as giving every user full access to everything can lead to multiple issues in a business going forward.

Risks

Risking access and compromising the entire infrastructure is the reason access rights should be managed. Staff being able to access client data and copy and move things or even delete key informational assets is a huge risk to businesses. Enabling most users to have full access enables more entry points for attacks having fewer with access and reviewing allows a reduction in the surface that needs to be covered.

Common mistakes

Full access for senior members, this might seem odd however they are often targeted by spear phishing. Most managing directors are publicly known or easily found this enables people to target them. Giving permanent instead of temporary access and not recording the trail of access is also a flaw commonly found. Why does someone need permanent access to finish a task? And who has access at any given time needs to be recorded.

Access reviews

Access reviews should be held continually to ensure rights arent abused and given to the wrong individuals going forward. This can be done as frequent as needed and can be done for individual products

A previous week’s cyber news article is available here.

For more information around SSO a link to Microsoft is available here.