How to control who has access to your business systems

In many small businesses, access to systems grows in a disorderly way. An employee is given administrator rights to install a program and still has them years later. A former colleague's email account is still active. Everyone uses the same password to get into the finance system. None of these situations seems serious on its own, but together they greatly increase the impact of a leaked password or a compromised computer.

Why access control matters

Most incidents involve, at some point, the use of a legitimate credential: a password obtained through a phishing scam, reused from another service or simply weak. When that happens, what the attacker can do depends on the access that account has.

An account with restricted access limits the damage. An administrator account used day to day for reading email and browsing the web can hand over control of the entire environment. This control exists to reduce that impact and is one of the five technical controls of the UK Cyber Essentials scheme.

Basic principles

One account per person

Each user should have their own account, with an individual password. Shared logins make it impossible to know who did what and make it hard to remove one person's access without affecting everyone else.

Least privilege

Each person should have access only to what they need for their role. The sales team does not need access to payroll; the intern does not need permission to install software.

Separate administrator accounts

Anyone who needs administrator privileges should have two accounts: a standard one for everyday work and an administrative one used only for administration tasks. The administrator account should not be used for reading email or browsing the internet, precisely the activities where the risk of contact with malicious content is highest.

Authentication: passwords and multi-factor

Passwords are still the most common form of authentication, and their quality makes a difference. Some practical guidance:

• Prefer long passwords, such as passphrases, over short, complex combinations that are hard to remember.
• Do not reuse your work password on other services.
• Adopt a password manager to make it easier to use different passwords.
• Change all default passwords on systems and equipment immediately.
• Limit login attempts or apply a temporary lockout after repeated failures.

Multi-factor authentication (MFA) adds a second check, such as a code in an app or a physical security key. Even if the password is discovered, access depends on something the attacker does not normally have. Cyber Essentials requires MFA on cloud services, such as business email, file storage and management systems accessed over the internet.

The account lifecycle

Access control does not end when an account is created. It needs to follow each person's journey through the business:

1. Joining: create the account with the access needed for the role, and nothing more.
2. Changing role: review access, removing what is no longer needed. Accumulating permissions over time is a common problem.
3. Leaving: remove or disable accounts as soon as the person leaves the business, including cloud services and third-party systems.

Accounts that are no longer used, including those of suppliers, tests or old projects, should also be removed or disabled. A periodic review, quarterly or every six months, helps to find these cases. It is worth linking this process to HR, so that IT is notified whenever someone joins, moves or leaves.

Relationship with the UK GDPR

Restricting access to personal data to those who need it is one of the most concrete ways of applying the appropriate security measures that Article 32 of the UK GDPR requires. Good access control reduces the number of people and systems involved in a potential personal data breach, a topic explored in cyber security and the UK GDPR. It is also one of the pillars described in the five basic cyber security controls.

Checklist

• Each person has their own account, with no shared logins.
• Administrator accounts are separate and used only for administration.
• Multi-factor authentication is enabled on email and other cloud services.
• Default passwords on systems and equipment have been changed.
• Accounts belonging to former employees and unused accounts are removed or disabled.
• Access is reviewed periodically, with support from HR.