Access Control

Access control is the discipline of deciding who may reach which systems, data, and actions — then enforcing those decisions technically and revoking them when the need ends. It answers three questions continuously: who are you (authentication), what are you allowed to do (authorization), and is that still appropriate (review and revocation). Nearly every attack that follows a successful deception runs on access-control weaknesses: the phished account that opened far more than its owner's job required, the departed contractor whose login still worked, the help-desk reset that handed an attacker a privileged identity.

How it works

Modern programs centralize decisions in an identity provider, so one directory governs who exists and single sign-on governs where they can go. Authorization models assign rights by role or attribute rather than person by person, with least privilege as the governing principle: each identity gets the minimum access its function requires, and sensitive rights sit behind privileged access management with elevation granted just-in-time instead of permanently. The lifecycle matters as much as the model — access is granted on joining, adjusted on role change, and removed on departure, with periodic user access reviews catching what automation missed. Where the model is weak, access quietly accumulates, and every over-permissioned account raises the payoff of compromising its owner.

How to defend

Start where the blast radius is largest: inventory privileged and service accounts, remove standing admin rights, and require phishing-resistant authentication on anything that can move money or data. Close the lifecycle gaps that social engineers exploit — same-day deprovisioning for leavers, scripted identity verification before the help desk resets credentials or enrolls a new MFA device, and documented approval for third-party and OAuth grants. Then watch the human seam: access-control failures surface as people problems first, which is why departing-employee access and help-desk impersonation deserve their own playbooks. Technical enforcement decides what an account can do; training and verification culture decide whether the attacker ever gets the account.