Category: blog
Identity and access management controls who can access business systems, what they can access, and when access is removed.
For SMBs, IAM does not require a large security department.
It requires consistent controls across:
- User accounts
- Applications
- Cloud services
- Devices
- Administrators
- Vendors
- Service accounts
- Business data
X-Tek managed security services help monitor and maintain these controls across business environments.
Access
IAM answers four operational questions:
- Who is requesting access
- Is the identity verified
- What permissions are required
- When should access end
Weak IAM creates common attack paths.
- Reused credentials
- Unprotected administrator accounts
- Former employees with active logins
- Excessive permissions
- Unmanaged vendor accounts
- Duplicate or dormant identities
- Shared credentials with no owner
The goal is controlled access.
Not unlimited access with security added later.
MFA Must Be the Baseline
Multifactor authentication requires more than a password.
The strongest common factors include:
- Something known such as a password
- Something possessed such as a security key or mobile device
- Something inherent such as a biometric
MFA should be enabled for:
- Microsoft 365 or Google Workspace
- Cloud file storage
- VPN and remote access
- Financial applications
- Payroll systems
- Backup consoles
- Security platforms
- Administrator accounts
- Applications containing customer or employee data
CISA recommends MFA for email, remote access, file storage, privileged access, and administrative access.
MFA implementation order
Start with privileged accounts.
Then protect:
- Identity provider accounts
- Email accounts
- Remote access systems
- Financial and HR platforms
- Backup and security tools
- All workforce accounts
Phishing-resistant methods should be preferred where supported.
Examples include:
- FIDO2 security keys
- Passkeys
- WebAuthn authentication
Authenticator applications are generally stronger than SMS codes.
SMS may still be required for limited legacy systems. It should not be the preferred method for administrator access.
Recovery controls also require review.
- Store recovery codes securely
- Register backup methods for administrators
- Restrict who can reset MFA
- Monitor MFA method changes
- Test recovery procedures
- Alert on unexpected enrollment
MFA does not replace other controls.
It reduces credential-based risk.
Least Privilege Limits Exposure
Least privilege gives users only the access required for their current work.
No more.
A user who handles invoices may need access to accounting systems.
That user may not need:
- Domain administrator rights
- Backup console access
- Production servers
- HR records
- Network equipment
- Security policy configuration
Permissions should be assigned through roles and groups rather than individual exceptions.
Example groups:
- Finance
- Sales
- Operations
- Support
- Human Resources
- Managers
- Administrators
Each group should have:
- A business owner
- A defined purpose
- Documented permissions
- A review schedule
- An approval process
Administrative access should be separated from daily user access.
Administrators should use:
- A standard account for email and routine work
- A separate privileged account for administration
- MFA on every privileged account
- Time-limited elevation where available
- Logging for administrative actions
Local administrator rights should be removed from ordinary workstations where practical.
Privileged access should be reviewed more often than standard access.
Focus on:
- Global administrators
- Application administrators
- Billing administrators
- Backup administrators
- Firewall administrators
- Cloud administrators
- Users who can reset MFA
- Users who can create accounts
- Users who can approve OAuth applications
- Users who can issue API keys
CIS Control 6 addresses access control management.
Offboarding Must Be Immediate
Employee offboarding is an access control event.
It should not depend on a manager remembering every application.
When employment ends, access should be disabled according to a documented procedure.
Required actions include:
- Disable the primary identity
- Revoke active sessions
- Revoke refresh tokens
- Remove group memberships
- Disable VPN access
- Disable remote desktop access
- Remove application access
- Rotate shared passwords
- Revoke API keys owned by the user
- Recover company devices
- Recover security keys
- Transfer business files according to policy
- Preserve records subject to legal or retention requirements
- Document completion time
The identity should be disabled immediately when the termination is effective.
Downstream applications must also be reviewed.
Commonly missed systems include:
- Microsoft 365
- Google Workspace
- Payroll
- Accounting
- CRM
- Project management
- Cloud hosting
- Source control
- Backup platforms
- VoIP administration
- Social media
- Vendor portals
Suspension may be preferable to deletion when records must be retained.
Suspension must still block authentication.
Role changes require the same discipline
Access often accumulates after an employee changes roles.
Old permissions remain active.
New permissions are added.
The result is privilege accumulation.
A mover process should remove prior access before assigning the new role.
Required records:
- Effective date
- New department
- New manager
- New role
- Permissions added
- Permissions removed
- Approval
- Completion timestamp
A ticketed workflow is sufficient when automation is not available.
The workflow must have:
- A named owner
- A defined deadline
- Required checkboxes
- Evidence of completion
- Escalation for missed actions
Directory Hygiene Reduces Risk
The directory is a security control.
It must remain accurate.
At least quarterly, review for:
- Dormant accounts
- Duplicate accounts
- Orphaned accounts
- Former employees
- Unowned service accounts
- Stale guest accounts
- Unused vendor accounts
- Shared accounts
- Excessive group memberships
- Nested groups with unclear purpose
- Unused administrator accounts
- Expired contractors
- Missing managers
- Missing department information
- Missing start and end dates
Every account should have an owner.
Every shared account should have a documented exception.
Shared accounts should be replaced with named accounts where possible.
Service accounts require separate controls.
- Business purpose
- Technical owner
- Application owner
- Credential storage location
- Rotation schedule
- Required permissions
- Expiration date where supported
- Monitoring
Directory naming standards also matter.
Use consistent names for:
- Users
- Groups
- Devices
- Service accounts
- Applications
- Vendors
- Administrator accounts
Remove abandoned groups.
Review external sharing.
Monitor directory audit logs for:
- New administrator assignments
- MFA method changes
- Password resets
- New OAuth consent
- New application registrations
- Disabled logging
- Unusual sign-ins
- Bulk group changes
- Unexpected account creation
CIS Control 5 covers account management and account inventory.
Managed Security Makes IAM Repeatable
IAM is not a one-time configuration.
Users change roles.
Applications change.
Vendors change.
Threats change.
Permissions must be reviewed and monitored as part of ongoing security operations.
X-Tek supports SMB environments with managed IT services, Microsoft and Google cloud services, network maintenance, security monitoring, and identity protection capabilities.
Review X-Tek business IT services.
Managed security operations may include:
- Account inventory reviews
- MFA enforcement
- Privileged access monitoring
- Endpoint privilege management
- Offboarding coordination
- Group and permission reviews
- Suspicious sign-in investigation
- Vendor access review
- Security alert escalation
- Backup console access control
- Documentation and reporting
Responsibilities should be defined in writing.
The business retains ownership of:
- Employee status
- Role assignments
- Business approvals
- Data ownership
- Vendor authorization
- Policy exceptions
The managed security provider operates the technical controls according to that policy.
Review provider access as well.
- Separate accounts for each technician
- MFA for provider personnel
- Least privilege permissions
- Time-limited elevation
- Activity logging
- Defined termination process
- Credential rotation
- Emergency access procedures
Do not use shared provider credentials.
A 90-Day IAM Plan
Days 1–30
- Select the primary identity provider
- Inventory users and administrators
- Inventory applications and vendors
- Identify service and shared accounts
- Enable MFA for administrators
- Enable MFA for email and remote access
- Disable former employee accounts
- Document emergency accounts
- Identify critical applications
Days 31–60
- Create role-based groups
- Separate standard and administrator accounts
- Remove unnecessary local administrator rights
- Document joiner, mover, and leaver procedures
- Set offboarding deadlines
- Review high-risk application permissions
- Centralize identity and security logs
- Assign owners to service accounts
Days 61–90
- Automate provisioning where supported
- Configure application deprovisioning
- Complete a quarterly access review
- Test an offboarding workflow
- Rotate stale credentials and API keys
- Review vendor access
- Document exceptions
- Produce evidence for management and compliance needs
Useful evidence includes:
- Identity inventory
- Application inventory
- MFA enforcement report
- Administrator list
- Group and role definitions
- Access review approvals
- Offboarding tickets
- Deactivation timestamps
- Audit logs
- Exception approvals
- Recovery test results
The Operating Standard
A practical SMB IAM standard is direct:
- Every identity has an owner
- Every administrator uses MFA
- Every user receives only required access
- Every role change removes outdated permissions
- Every terminated user is disabled immediately
- Every vendor account has an expiration or review date
- Every service account has a documented purpose
- Every sensitive permission is reviewed quarterly
- Every exception has approval and an end date
- Every control produces evidence
IAM is one part of managed security.
It works with endpoint protection, patch management, backup verification, network monitoring, and incident response.
Read X-Tek’s guide to proactive network security.
Contact Information
Business Solutions Information Request:
https://xtekit.com/business-solutions-information-request/
815-516-8075