An employee gets a convincing Microsoft 365 email, clicks the link and enters their password.
By the time anyone realizes what happened, someone else has their login.
That is obviously a problem. The more important question is how big a problem.
If that employee has access to their email, a few shared folders and the applications they use every day, there is still work to do, but the damage has some boundaries.
If the same account can also reach customer records, accounting files, administrative tools and folders left over from jobs the employee held three years ago, things get more troubling very quickly.
The danger is not simply that an account can be compromised. It is that a single account may be able to reach far more of your business than anyone realizes.
Access Rarely Gets Out of Hand All at Once
Nobody sits down on an employee’s first day and decides to give them access to half the company.
It happens gradually.
Someone in your Nanaimo business began their employment in sales, so they got the CRM and sales folders. A year later they helped with purchasing and needed access to another system. Someone went on vacation, so they covered part of that job for a few weeks. Eventually they moved into a different position and received a whole new set of permissions.
Every decision made sense when it was made.
The problem is that new access tends to get added much more reliably than old access gets removed.
Over a few years, an employee can accumulate permissions that bear very little resemblance to the job they do today.
There is an IT term for this, privilege creep, but the problem itself is wonderfully ordinary: people keep the keys nobody remembered to ask for back.
Give the Job the Access, Not the Person
One of the better ways to avoid this is to build permissions around roles.
Instead of deciding individually what the new person in accounting should be able to access, decide what someone in accounting needs to do their job.
Do the same for sales, management, administration and other common roles in the business.
This is called role-based access control, and despite the impressive name, it is mostly about keeping things organized.
A new employee inherits the appropriate access for the position. When someone changes jobs, their permissions change with the job. When they leave, you already know which access needs to be removed.
Enough to Do the Job Is Usually Enough
Role-based access works well with another simple idea called the principle of least privilege.
Give people what they need to do their work without giving them access to things they do not need.
This is not about making employees ask permission every five minutes. It is about avoiding unnecessary reach.
The person who updates your Nanaimo business website probably does not need administrator rights to Microsoft 365. A salesperson does not need payroll files. A contractor brought in to work on one system does not need an open door into three others.
If an account ever gets compromised, the fewer open doors the better.
The Permissions You Forgot About
Temporary access deserves particular attention because temporary has a funny way of becoming permanent.
Someone covers for a coworker. A vendor needs access during an installation. A manager joins a project for three months.
Six months later, the project is finished and the access is still there.
That is why it helps to attach an end date to temporary permissions or make removing them part of finishing the project.
The same thinking should apply when employees change roles or leave the company. Reviewing access should be part of the change, not something everyone hopes IT remembers later.
Have a Look Once in a While
Even a well-organized system will drift as a business changes.
A periodic review does not need to become a week-long security exercise. For many Nanaimo businesses, it can start with a handful of sensible questions.
Who has administrator access? Are former employees completely gone? Do outside vendors still have accounts? Are people carrying permissions from jobs or projects they no longer have? Do we need to change how we implement access control and authorization?
You may find everything is exactly as it should be. You may also find a few keys nobody realized were still out there.
At NCI Technical, we help Nanaimo businesses organize user permissions and access around the way their people actually work, and keep it organized as those roles change.
Because if one employee’s login ever falls into the wrong hands, you want the answer to “What can they get into?” to be a very short one.
