Access management, from password to proof
Almost every incident starts at an account: a password leaked elsewhere, an administrator who still had rights, an old account never closed. Access management is closing those three, and it is the cheapest security there is.
IAM, PAM and MFA, pulled apart
They are used interchangeably and solve different things.
- MFA, two-step verificationA second proof alongside the password. This is the measure with the best ratio of effect to effort, and the only one that makes a leaked password worthless. Start here.
- IAM, identity and access managementOne place accounts come from, with a process granting rights on joining and revoking them on leaving. Without this there is always a list of accounts nobody recognises.
- PAM, privileged accessThe passwords with which somebody enters a server or firewall, in a vault, issued per session and rotated afterwards. This is the smallest group of accounts and the largest damage when it goes wrong.
The order that returns most
Four steps. The first can be done next week, the last is a project.
Switch MFA on everywhere
Starting with email and everything reachable from outside. This is days of work and removes the bulk of the risk.
Clean up the account list
Who is on it, who still works there, who has rights that do not belong to their job. Every organisation finds accounts here of people who left years ago.
Write down the process
Joining, changing role and leaving in one agreement with HR. Without that the list fills up again within a year.
Separate administrator access
Administrators work with an ordinary account and only draw their rights when they need them. This is the step with the most resistance and the most gain.
What belongs with this
Access is the foundation zero trust and compliance stand on.
Start with the cheapest measure
Tell us what people sign in to now and whether two-step verification is on. You get an order of work with what is already possible this month.
Practical IT knowledge in your inbox
New guides on management, security and the workplace, written by the people doing the work. No sales talk, and you can unsubscribe in one click.