When an account opens more doors than it should

An account may initially have exactly the permissions it needs and, over time, retain permissions that are no longer appropriate for its role. Changes in job role, completed projects or temporary responsibilities can leave permissions active long after they are needed.

If the account is compromised, the access it retains determines which resources the attacker can reach and what actions they can attempt.

Protecting a digital identity involves more than preventing password theft or strengthening authentication. It also matters which applications, systems and data the associated account can access, what actions it is allowed to perform, how long those permissions are needed and how far an attacker could progress if they managed to use the account.

■ A compromised account does not have to result in widespread access to company systems. Applying the principle of least privilege, limiting unnecessary connections between systems and removing permissions that are no longer required reduces the resources and actions available to an attacker.

Getting in is only the first step

Passwords, multi-factor authentication (MFA) and technologies such as passkeys make it harder for an unauthorised person to gain access using someone else's credentials. These controls strengthen authentication and, in the case of passkeys, can reduce reliance on passwords.

However, verifying an identity only establishes who is gaining access; there is still the question of what the account is allowed to do once inside.

This means determining which applications the identity can access, what actions it can perform and whether those permissions need to remain in place permanently. Identity and access management turns these decisions into policies governing who can access which resources, with what permissions and under what conditions.

Zero Trust-based access models start from a simple principle: passing an initial check should not automatically provide access to more resources than necessary. Access can be adjusted according to the application, context and level of risk.

The distinction becomes clearer in common situations:

• An employee in Finance needs certain applications to do their job, but not necessarily access to every financial system.
• A supplier may need access to a platform for the duration of a project, but not to the rest of the corporate network.
• A user with administrative responsibilities may need elevated privileges for a specific task without needing to use them continuously.

Authentication tells us who is trying to get in; the next step is deciding how far they should be able to go.

Permissions that were once necessary may no longer be needed

Unnecessary access does not always result from a misconfiguration or a poor decision. For example, someone may be given access to a specific tool to work on a six-month project and later move into a different role. Another employee may transfer to a different department. A supplier may finish a piece of work. In all of these cases, granting the permission may have been entirely appropriate at the time.

The risk arises when the need disappears but the access remains.

The more applications and resources an account can reach, the greater the potential scope of a compromise. The risk increases further if the account has elevated privileges, because these may allow changes to be made, systems to be administered or information to be accessed that is unavailable to a standard user.

Accounts with elevated privileges require specific controls. Privileged Access Management can protect credentials, enforce policies, isolate sessions and monitor actions performed using those privileges.

■ Identity management does not end when an account is created. It also covers changes in role, temporary access, changes to privileges and account deprovisioning.

A permission can become unnecessary even if granting it was the right decision at the time.

What changes when an account falls into the wrong hands

An account can be compromised in different ways. Phishing and credential theft remain possible routes. There are also attacks that exploit compromised devices or attempt to reuse authenticated sessions.

How the compromise occurs affects both detection and the response required. The resources and actions available to the account also determine the scope of the incident:

• If the account can access only the resources required for a specific role, the potential scope is more limited.
• If it retains numerous permissions, has elevated privileges or provides access to other systems, the attacker may attempt to extend the compromise.

When an attacker uses a compromised account or system to reach other resources, this is known as lateral movement. In our article on microsegmentation, we explain how internal connections and excessive permissions can facilitate this movement and how restricting communications can help contain it.

■ Microsegmentation is one possible technical measure. The broader principle is that security should make it harder to gain access and limit how far an attacker can progress once access has been obtained.

Not all access needs to be permanent

Not all permissions need to remain active for the same length of time. Some access is required on an ongoing basis for a particular role. Other permissions exist to carry out a specific task: an administrative intervention, a project, an audit or temporary work carried out by a supplier.

In these cases, leaving the permission in place indefinitely means it can still be used even after the task or relationship that justified granting it has ended.

Temporary or just-in-time access models reduce this exposure by granting specific privileges when they are needed and removing them afterwards. This principle is particularly useful for accounts that can administer systems or perform sensitive operations.

■ Access reviews should distinguish between permissions that genuinely need to remain active and those that are still in place simply because nobody has reviewed them.

Trust does not have to last forever

The conditions surrounding an access session can change after authentication. During a session that begins under normal circumstances, signals may emerge suggesting that the access is no longer legitimate or should be reviewed: use from an unrecognised device, activity that does not match the expected pattern, a particularly sensitive operation or indications that the account has been compromised.

Successful authentication at the start of a session does not mean that every subsequent action should automatically be trusted. If the device, location, risk level or sensitivity of the operation changes, it may be necessary to verify the access again or restrict certain actions.

This approach to access management reflects a broader evolution of digital identity as the foundation of trust: beyond verifying who is accessing a resource, it is also necessary to establish which resources each identity can use, what actions it can perform and under what conditions access should be reassessed.

Identity exposure analysis can identify excessive permissions, privileged accounts without appropriate controls and combinations of configurations or trust relationships that could create an attack path after an account is compromised.

■ Behaviour that differs from the norm does not constitute an incident on its own. What matters is being able to reassess trust when the conditions under which access was granted change significantly.

An access review starts with understanding what is still needed

Reducing the potential scope of a compromised account requires reviewing decisions that tend to accumulate over time.

The review can begin by checking how authentication is handled for relevant access and which accounts require stronger protection through MFA or other appropriate mechanisms. The next step is to review which permissions are still active and whether they continue to serve a genuine need. Changes in role, completed projects or the end of a supplier relationship can leave behind access that should no longer remain in place.

The same review should pay particular attention to who has elevated privileges, why they need them and for how long. Where those privileges are required only for a specific task, organisations can consider having them expire or be removed once the task is complete.

It is also important to consider how far an attacker could move from a compromised account or system. Least privilege, access control and segmentation help reduce the likelihood that an initial compromise will spread to other resources.

Once an incident has occurred, the ability to act quickly becomes especially important. Blocking an account, removing privileges or terminating sessions can reduce the amount of time for which compromised access remains useful to an attacker.

■ These checks can help identify unnecessary permissions, excessive access and attack paths that could increase the impact of a compromise.

Protecting an account also means limiting what it can do

A company needs employees, contractors and suppliers to be able to access the resources they require to work. Restricting permissions indiscriminately would make it harder to operate; granting them without sufficient control would increase risk.

The balance lies in giving each identity what it needs for as long as it needs it.

Strong passwords, MFA and other authentication mechanisms protect the point of entry. Permission reviews, privileged access controls, context-based decisions and segmentation limit the potential scope once access has been granted.

■ A compromised account is already a security incident. The difference lies in how much the attacker can do with it: limiting permissions, access and paths for lateral movement reduces the likelihood that an initial compromise will spread across the environment.