Enforcing Authentication
Authentication checks that users are really who they say they are before letting them in. Good authentication means more than just passwords — it includes:
- Multi-factor authentication (MFA)
- Strong password rules
- Locking accounts after too many failed login attempts
- Modern login standards (like OAuth 2.0 or SAML)
- Passwordless options (security keys, passkeys) where possible
- Regular checks to remove old or unused accounts, since these are an easy target for attackers
Controlling Access Permissions
Once someone is logged in, they should only be given the access they actually need to do their job — nothing extra. This is called the principle of least privilege. (see Access Control Lists)
Permissions should be reviewed regularly (especially when someone changes roles or leaves) to avoid people building up access they no longer need — known as privilege creep.
Role-based access control (RBAC) makes this easier by grouping permissions by job role instead of setting them one by one.
Admin-level access should be limited, time-restricted, and closely monitored.