Ask a business owner: “how many people have access to your servers today?” The answer comes quickly, and it is almost always wrong. Not through negligence, but because no one has ever made the list.
Access management is the area where the gap between what people believe and reality is greatest. Accounts pile up, rights get added, no one ever removes anything. And the day someone actually looks, they find active accounts belonging to people who left years ago.
What is least privilege, without the jargon?
The principle fits in one sentence: everyone accesses what they need for their job, nothing more. The accountant accesses the accounting system. The salesperson accesses the client file. Neither one needs access to personnel records.
The first reaction is often defensive. Restricting access can feel like distrust toward employees. That is a misunderstanding, and it is worth clearing up right away.
Least privilege does not protect you from your employees. It protects you from the attacker who will one day take control of one of their accounts. A password stolen through phishing gives the attacker exactly the rights of its owner. If that account only opens part of the company, the incident stays contained. If it opens everything, the incident becomes a disaster.
This is a compartmentalisation logic, the same one behind fire doors in a building. They are not installed because the occupants are suspected of being arsonists. They are installed so that fire does not spread.
An administrative employee opens a booby-trapped attachment. In an SME where her account only accesses her own working folders, the attacker encrypts those folders and the company restores yesterday's backup. In an SME where she is administrator of her machine and every folder on the server is open to everyone, the same click gives access to accounting, contracts, personnel data and backups reachable from the network. The click is identical, the bill is not.
The administrator account, the damage multiplier
An administrator account is one that has the right to change anything on a machine or in a service: install software, change security settings, create or delete other accounts.
In many SMEs, everyone works with this level of rights. Sometimes because it was simpler to set up, sometimes because a business application required it ten years ago and no one has checked since.
The problem is mechanical. Malicious software runs with the rights of the person who launched it. Opened from a standard account, it is limited to what that person can reach. Opened from an administrator account, it can disable antivirus protection, install itself permanently, spread to other machines and delete local backups.
The rule applies to everyone, including the owner, and especially to whoever handles IT. Good practice is simple: two accounts for the same person, a standard account for reading e-mail and working, and a separate administrator account used only for tasks that require it. E-mail and web browsing are never opened from the second account.
What to do about shared team accounts?
They are everywhere in SMEs. An info@ address that three people check with
the same password. A single account on the management software, because
extra licences are expensive. Access to online banking “for accounting”.
These accounts create three distinct problems.
You no longer know who did what. When an invoice is modified or a transfer prepared, the log shows the account name, not the person’s name. In the event of an error or fraud, the internal investigation stops right there.
The password circulates and outlives departures. It ends up in an e-mail, on a sticky note, on someone’s personal phone. When a person leaves the company, they still know it, and no one changes it because that would mean notifying everyone else.
Two-factor authentication becomes impractical. Which phone should the code go to, if the account belongs to four people?
The solution is not to remove shared use, but to separate it from identification. Everyone keeps a named account, and is granted access to the shared resource. For e-mail, this is called a shared mailbox, and every serious provider offers it. For business software, it is a licensing question to raise with the vendor.
Contractors and remote maintenance
Your IT provider, the vendor of your management software, the company that maintains your badge system: all of them probably have remote access to your systems. Often created during installation, often permanent, often never reviewed.
These accesses deserve particular attention, because they are technically powerful and entirely outside your view. They are also a sought-after target: compromising a provider gives access to all of its clients at once, a pattern detailed in our article on supply chain attacks.
Three reasonable requirements to put in writing in your contract.
Access is activated on request rather than permanent, or at minimum protected by two-factor authentication. Each technician has a named account rather than a generic account shared within the provider. And you can review the connection log on simple request.
A competent provider will accept these three points without difficulty. Reluctance is in itself useful information.
Dormant accounts, what you don’t know you have
The intern from summer 2021. The test account created to validate a migration. Access to the old scheduling tool no one uses any more but whose server still runs. The former sales director who left in 2023, whose account was “deactivated later, probably”.
These accounts share two troubling traits: no one monitors them, and their password has not changed in years. If it appears in a public data breach, an attacker can log in without anything raising an alert, since no colleague will notice unusual activity on an account that everyone has forgotten.
This is where the most honest point of this article lies. You cannot verify what you do not know exists. An owner who conscientiously fills out a security checklist ticks “access under control” while thinking of the ten people on the org chart. They do not think about the service account created by a provider in 2019, or the access left open on a supplier’s portal.
Which accesses to cut when an employee leaves?
This is the moment when everything shows. Here is the list of accesses to cut, including the ones that are systematically forgotten.
| Category | To cut | Often forgotten |
|---|---|---|
| IT | Session account, e-mail, online storage | Personal accounts on business services |
| Remote | VPN, remote desktop, access from outside | Apps installed on a personal phone |
| Applications | Business software, accounting, HR, e-banking | Supplier portals, insurance, social security funds |
| Shared | Shared passwords to change | Social media, website, domain name |
| Physical | Badge, keys, alarm | Work phone, locker, safe |
This list has a twin, forgotten even more often: the one for arrivals. The same accesses open up then, and it is the only moment when internal rules get put in place effortlessly, as detailed in our article on onboarding a new employee.
Two reflexes are worth more than one long procedure. Build the list before the first departure, not during, and have it reviewed by whoever knows IT best. Then, at each departure, note the date each access was cut. This record will help you the day you wonder whether someone’s account was actually closed.
How to run an annual access review?
An annual review is a simple exercise, taking half a day in a twenty-person SME. It happens in four stages.
List the services. Every place where your company has accounts: workstations and servers, e-mail, business software, banking, website, social media, online storage, remote access, external portals. These remote accesses deserve a line of their own as soon as part of the team works outside the premises, a case we cover in remote work and mobile devices.
Request the list of active users from each service, or export it. This is the step that produces surprises.
Compare this list against your actual org chart. Every account must correspond to a person currently present. Everything else should be removed, or documented if it is a necessary technical account.
Check administrator rights. Who is an administrator, of what, and why. The list is almost always longer than expected.
An access review never happens "when there's time". Put it on the calendar for a fixed date, for example alongside the annual closing, and assign it explicitly to someone. A task with no date and no owner does not exist.
These measures form a solid foundation, and they are within reach of any SME without a special budget. They do not replace an analysis of your own situation: the accesses that really matter for you depend on your business, your workflows and your providers, and some do not appear on any generic list. An outside perspective is mainly useful for finding what you were not looking for.
To gauge your current level, the cyber check-up devotes several questions to access management. Access management goes hand in hand with backups kept out of reach and with the security obligations set out in the FADP. The full set of priority measures is grouped in the Good practices pillar.