WDTD | 𝗣𝗼𝘀𝘁 #𝟯𝟲𝟬
A few years ago, an auditor asked a simple question during a review:
“𝗪𝗵𝗼 𝗮𝗽𝗽𝗿𝗼𝘃𝗲𝗱 𝘁𝗵𝗶𝘀 𝗮𝗰𝗰𝗲𝘀𝘀?”
Everyone in the room knew who had access.
Nobody knew why.
That distinction matters more than most organizations realize.
Over time, permissions accumulate.
Projects start.
Teams expand.
Vendors are onboarded.
Emergency access is granted.
New applications are deployed.
And little by little, access becomes part of the environment.
Rarely challenged.
Rarely questioned.
Simply inherited.
The problem is that access without purpose eventually becomes risk without visibility.
𝗪𝗲’𝘃𝗲 𝗿𝗲𝘃𝗶𝗲𝘄𝗲𝗱 𝗲𝗻𝘃𝗶𝗿𝗼𝗻𝗺𝗲𝗻𝘁𝘀 𝘄𝗵𝗲𝗿𝗲:
- Users had administrator privileges for systems they hadn’t touched in years
- Third-party vendors retained access long after contracts ended
- Service accounts were running critical processes without an identified owner
- Shared mailboxes contained sensitive information but had dozens of authorized users
- Nobody could explain the original business justification behind key permissions
What struck me wasn’t the existence of the access.
It was the absence of accountability.
Because every permission should answer three simple questions:
𝟭. 𝗪𝗵𝗼 𝗵𝗮𝘀 𝗮𝗰𝗰𝗲𝘀𝘀?
𝟮. 𝗪𝗵𝗮𝘁 𝗰𝗮𝗻 𝘁𝗵𝗲𝘆 𝗮𝗰𝗰𝗲𝘀𝘀?
𝟯. 𝗪𝗵𝘆 𝗱𝗼 𝘁𝗵𝗲𝘆 𝘀𝘁𝗶𝗹𝗹 𝗻𝗲𝗲𝗱 𝗶𝘁?
Most organizations focus heavily on the first two.
The third is where governance often breaks down.
A useful exercise for any audit, security, or governance team:
𝗣𝗶𝗰𝗸 𝟮𝟬 𝗿𝗮𝗻𝗱𝗼𝗺 𝗽𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲𝗱 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀.
Then ask stakeholders to explain the business justification for each one.
Not the technical reason.
The business reason.
The results are often eye-opening.
Good security isn’t just about restricting access.
It’s about ensuring every access decision remains intentional.
The moment access becomes “normal” instead of “justified,” risk begins to accumulate quietly in the background.
And eventually, someone will inherit privileges that nobody remembers granting.
That’s usually where the story starts.
Leave a Reply