The whole category in one page.
ACCESS ACCUMULATES AND NOTHING REMOVES IT AUTOMATICALLY
People gain access when they change roles and rarely lose it, so individuals end up reaching far more than their work requires — and a single compromised account reaches all of it.
MULTI-FACTOR AUTHENTICATION MATTERS MORE THAN ANY OTHER SINGLE MEASURE, AND EMAIL COMES FIRST
Email is the recovery route for every other account. Prefer application codes or hardware tokens over message-based codes, since phone numbers can be transferred to someone else.
TEACH PEOPLE THAT AN UNEXPECTED APPROVAL PROMPT MEANS SOMEONE ALREADY HAS THEIR PASSWORD — DENY IT AND CHANGE THE PASSWORD
REMOVE ACCESS ON THE LAST DAY, ACROSS A CHECKLIST RATHER THAN FROM MEMORY
Include shared credentials, which must be changed, and anything registered in the person's own name.
NEVER COPY ANOTHER PERSON'S ACCESS WHEN SETTING SOMEONE UP, BECAUSE IT PROPAGATES EVERYTHING THEY ACCUMULATED
GIVE EVERY EXTERNAL GRANT AN EXPIRY DATE AND AN INTERNAL OWNER, SINCE THAT IS THE ONLY RELIABLE WAY CONTRACTOR ACCESS EVER ENDS
CHANGE DEFAULT CREDENTIALS ON EVERY DEVICE AND SERVICE, AS THEY ARE PUBLISHED AND THEY ARE THE COMMONEST ROUTE IN
KEEP ADMINISTRATORS ON ORDINARY ACCOUNTS FOR ORDINARY WORK, AND STORE LOGS WHERE THOSE THEY RECORD CANNOT ALTER THEM
WHEN AN ACCOUNT IS COMPROMISED, CHECK FOR ADDED SECOND FACTORS AND MAIL FORWARDING RULES, WHICH ARE HOW ACCESS IS RETAINED AFTER YOU RECOVER IT
AND VERIFY THAT EVERY BUSINESS SERVICE IS REGISTERED TO AN ADDRESS THE BUSINESS CONTROLS, BECAUSE SERVICES SET UP BY ONE PERSON ARE LOST WHEN THEY LEAVE
