Oh, the access control tracking

One thing I’ve consistently seen way too much in my career has been a lack of proper access control tracking.

Forgotten accesses or orphaned accounts are among the top internal security vulnerabilities.

I recently created a Stripe account for my business, and my password manager auto-filled an old login username and password.

I accidentally logged into the wrong account and still had full access many years later.

The increasing number of SaaS products we use makes it clear that a system to track who has access to what is not just a luxury but an absolute necessity.

The thing is, it does not need to be complicated.

Set up an Access Control Log using Google Sheets, Notion, or another tool of choice.

Add:

• Username
• Role
• Resource or Service
• Access Level (Read, Write, Admin)
• Date Granted
• Date Revoked
• Granted By
• Comments

Then, have a checklist you follow whenever you are granting access to ensure you’ve made a record whenever someone is granted (or revoked) access.

When you want to fire Joe for (ab)using Uber Eats lunch coupons to buy toothpaste and wine, even though you’re paying him $500k in salary, you’ll know exactly which services to go through to cut all access before he can get revenge.

This literally takes 5s to do as you are creating an account for someone, but plenty of people still don’t do this.

If you want to upgrade, the next step is to adopt SSO (Single Sign-On) for key services and look into an IAM solution.

But that’s beyond the scope of today’s newsletter. The point is if you don’t currently have this under control, start with a Google Sheet.

Do a full audit and record all the tools you are using and all the accesses. It will take some time, and if you plug a hole that prevents you from getting hacked, remember:

No one will congratulate you on all the crises you’ve averted, but everyone will blame you for the one that wasn’t.

Be the hero in the shadows. 🦸♀️🛡️

Stay safe,

Taj