Lesson 12 of 16 · Level 3: Advanced
Identity and Access Management: Least Privilege
- ⏱ 12 min read
- ❓ 4 review questions
- ✍️ Exercise with solution
- 📥 Downloadable template
In this lesson
- The four steps of access control: identification, authentication, authorization and accounting.
- The principles of least privilege, need to know and separation of duties, with business examples.
- Access control models (DAC, MAC, RBAC, ABAC) and how to build a simple role matrix.
- How to protect privileged accounts and why single sign-on makes security easier.
- How to manage accounts from hire to exit and run a quarterly access review.
The Protect section of the small-business checklist includes the identity controls from this lesson: MFA, separate admin accounts, offboarding and quarterly access reviews.
- cybersecurity-checklist.xlsx · Small Business Checklist sheet
Identity and access management (IAM) answers a simple question for every person and system in an organization: who are you, and what are you allowed to do? Get it right and a stolen password or a careless click affects one small corner of the business. Get it wrong (everyone is an admin, former employees still have access, five people share one login) and a single compromised account can reach everything. This lesson teaches the principle at the heart of IAM, least privilege, and the routines that keep access tidy as people join, change roles and leave.
- Learn the four A's
- Apply least privilege
- Design roles
- Guard privileged accounts
- Manage the account lifecycle
The four steps of access control
Security frameworks and exams describe access as a sequence. Using a hospital billing system as the example:
| Step | Question | Example |
|---|---|---|
| Identification | Who do you claim to be? | Typing the username "jlopez" |
| Authentication | Can you prove it? | Password plus a passkey on her phone |
| Authorization | What are you allowed to do? | She can view and edit claims, but not change bank details |
| Accounting (auditing) | What did you actually do? | A log records that she edited claim #88214 at 10:42 a.m. |
Authentication and authorization are the pair people mix up most. Authentication proves identity; authorization decides permissions. A perfectly authenticated user can still be over-authorized, and that's the problem least privilege solves.
1. An employee logs in successfully with MFA, then tries to open the payroll folder and gets "Access denied." Which step blocked her?
She proved who she is (authentication succeeded), but her permissions don't include payroll. Authorization decides what an authenticated user may access.
Three principles that limit damage
Least privilege
Give each account only the access it needs to do its job, and nothing more.
Example: a receptionist can book appointments but can't export the patient database.Need to know
Even with the right clearance or role, see only the specific data your task requires.
Example: an HR assistant handling benefits doesn't need performance reviews.Separation of duties
Split sensitive tasks so no single person can complete them alone.
Example: one person adds a new vendor, a different person approves payments to it.Least privilege matters because attackers inherit the permissions of whatever account they compromise. If a phished account is an administrator, the attacker is an administrator. CISA's ransomware guidance specifically recommends limiting user permissions, separating admin accounts from user accounts and auditing accounts regularly.
2. At a small manufacturer, the same bookkeeper can create new vendors, enter invoices and release payments. Which principle is missing?
One person controls the entire payment chain, so a mistake, a fraud or a compromised account goes unchecked. Splitting "create vendor" from "approve payment" adds a second set of eyes.
Access control models
These four models appear in every security certification. In practice, small businesses mostly use DAC and RBAC.
| Model | Who decides access | Where you see it |
|---|---|---|
| DAC (discretionary) | The owner of each file or resource | Sharing a document with a coworker from your drive |
| MAC (mandatory) | A central policy based on labels and clearances | Government classified systems |
| RBAC (role-based) | Permissions attached to roles; people are assigned roles | "Billing specialist" role in a practice management system |
| ABAC (attribute-based) | Rules that combine attributes of the user, resource and context | "Managers may approve expenses under $5,000 from a managed device during business hours" |
Building a role matrix
RBAC starts with a simple table: roles down the side, systems across the top, the access level in each cell. Here's one for a fictional 40-person medical billing company in Tampa, Florida:
| Role | Billing platform | Patient data (PHI) | Payroll | Bank portal | Email admin |
|---|---|---|---|---|---|
| Billing specialist | Edit | Read (assigned clients) | None | None | None |
| Team lead | Edit + approve | Read | None | None | None |
| HR coordinator | None | None | Edit | None | None |
| Controller | Read | None | Approve | Approve payments | None |
| IT administrator | Admin (separate account) | None by default | None | None | Admin (separate account) |
Notice two details. The IT administrator manages systems but doesn't read patient data by default: managing a system isn't the same as needing its contents. And the controller approves payments but doesn't create vendors in the billing platform: separation of duties in a single row.
Privileged accounts: the keys to the kingdom
Administrator, root and global admin accounts can change settings, create users, read everything and turn off security tools. They're the first thing attackers look for after getting in. Protect them with extra layers:
Single sign-on (SSO): fewer passwords, more control
With SSO, employees sign in once to an identity provider (such as the one included with Microsoft 365 or Google Workspace) and then reach connected apps without separate passwords, using standards like SAML or OpenID Connect. The security benefits are big: one place to enforce MFA and device rules, one place to see sign-ins, and one switch to turn off when someone leaves. Prefer apps that support SSO when you choose new software.
The account lifecycle: joiners, movers and leavers
Access problems usually come from time, not technology: permissions pile up as people change roles, and accounts outlive the people who used them.
- JoinerStart with the role, not a copyGrant access from the role matrix. Never "copy Sarah's access," which spreads every extra permission Sarah ever collected.
- MoverRemove old access when adding newWhen someone changes teams, the old role's access goes away on the same day the new role's access is added.
- LeaverDisable on the last day, or soonerDisable the identity (which cuts off SSO apps), revoke sessions and tokens, collect devices, change shared secrets they knew and transfer file ownership.
- Every quarterAccess reviewManagers confirm, person by person, that each access is still needed. Anything not confirmed is removed.
Former employees can keep access through accounts SSO doesn't cover: social media pages, the domain registrar, a supplier portal, a shared vendor login. Keep a list of these "side doors" and include them in every offboarding.
Case: the Tampa billing company's first access review
A client clinic asked for evidence of access controls before renewing its contract. The first review found 49 active accounts for 40 employees: 9 belonged to people who had left. Most staff had local admin rights "because the printer driver needed it once." Over six weeks, the company built the role matrix above, removed admin rights, rolled out SSO with MFA and set quarterly reviews.
Admin rights cut by 91% (from 34 people to 3), orphaned accounts eliminated and the clinic's contract renewed.
3. A company reduces the number of people with global admin rights from 12 to 2. By what percentage did it reduce them?
(12 − 2) ÷ 12 = 10 ÷ 12 = 0.833, or 83.3%. The 16.7% that remains (2 of 12) is the share still holding admin rights.
Common mistakes
"Copy the access of the person who had this job before."
Grant access from a defined role. Copying spreads years of accumulated permissions.
Shared logins like "frontdesk@" used by five people.
One named account per person, so actions can be traced and access removed individually.
Admins reading email with their admin account.
Separate everyday and admin accounts; a phished everyday account then doesn't hand over the keys.
Waiting until "next week" to disable a departing employee.
Disable access at the end of the last day, or immediately for a termination.
4. An employee is being let go today after a dispute. When should her access be removed?
For involuntary departures, access is cut at the moment of notification to prevent damage or data theft. HR and IT should coordinate the timing in advance.
Practice exercise
Build a role matrix for a Phoenix dental office with these roles: front desk, hygienist, dentist, office manager and an outside IT provider. Systems: scheduling, clinical charts, billing and insurance claims, the bank portal, and the Microsoft 365 admin center. Use None, Read, Edit, Approve or Admin, and apply least privilege and separation of duties.
See solution
| Role | Scheduling | Clinical charts | Billing and claims | Bank portal | M365 admin |
|---|---|---|---|---|---|
| Front desk | Edit | None (or demographics only) | Edit (enter claims) | None | None |
| Hygienist | Read | Edit | None | None | None |
| Dentist | Read | Edit | Read | None | None |
| Office manager | Edit | Read | Approve | Approve payments | None |
| IT provider | None | None | None | None | Admin (separate account, phishing-resistant MFA) |
Why: front desk enters claims but the office manager approves them (separation of duties); the IT provider manages systems without seeing patient data (need to know); nobody but the office manager touches the bank portal; and the IT provider's admin access is reviewed every quarter like everyone else's.
Summary
- Access control runs in four steps: identification, authentication, authorization and accounting.
- Least privilege, need to know and separation of duties limit what any one account, or attacker, can do.
- Role-based access with a simple role matrix keeps permissions consistent and easy to review.
- Privileged accounts need separate logins, phishing-resistant MFA, minimal numbers and alerts.
- Manage the whole lifecycle: grant by role, remove on role changes and departures, and review access every quarter.
Next lesson: Monitoring, Logs and Threat Detection. You'll learn what to log, which warning signs deserve investigation and how to triage alerts without drowning in them.
Create your account in 30 seconds, mark your lessons and download your certificate at the end.