Access Control as the First Insider Control

Detection observes what people do with their access. Access control determines how many people could do anything at all, and it is the more powerful lever by a considerable margin.

It is also politically difficult, which is why organisations buy monitoring instead.

The arithmetic

If four hundred people can export the customer database, your insider risk population is four hundred. Detection tells you when one of them does something unusual.

If forty people can, the population is forty. Every subsequent control is ten times more tractable — baselines are meaningful, alerts are reviewable, investigations are proportionate.

Reducing access is the only measure that changes the denominator. Everything else operates on what remains.

Why access sprawls

Granted and never removed. Someone needs access for a project; the project ends; the access persists.

Role changes add without subtracting. The single largest cause. Four years and three moves produce someone who can reach everything.

Provisioned broadly to reduce friction. Particularly during rapid onboarding, where narrow access means a week of tickets.

Groups that accumulate. A group created for one purpose becomes the default for several, and its membership grows without anyone deciding.

Copies escaping the control. The database is restricted; the extract on the shared drive is not. This is where most real over-exposure lives.

What actually works

Review by data category, not by system. Take the categories from your inventory and ask who can reach each. This produces an answer people can evaluate. A list of group memberships does not.

Attach access review to role change, not only to an annual cycle. The mover event is where the sprawl originates and where it is cheapest to prevent.

Time-bound access by default for anything granted for a project or an exception. Expiry is far easier than revocation, because nobody has to decide to take something away.

Require justification at grant, recorded. Six months later the reviewer needs to know why this was given. Without it, review means asking a manager who says yes to everything.

Attack the copies. Restricting the system while ignoring the extracts achieves little. Find the copies during inventory and either control or delete them.

The privileged user problem

Administrators can generally reach anything, disable logging, and grant themselves access. They are simultaneously the smallest population and the highest consequence.

Separate accounts for administrative and ordinary work, so routine activity is not conducted with elevated rights.

Just-in-time elevation rather than standing privilege, with a request, an approval and an expiry.

Log to somewhere they cannot alter. Administrative activity logged to a system the administrators control is not evidence.

Two people for the most consequential actions — bulk export, log configuration changes, mass permission changes.

This population deserves proportionally more attention than the general workforce, and usually receives less because the people designing controls are frequently in it.

Why it is resisted

Removing access feels like an accusation. Managers experience it as a statement about their team's trustworthiness, and people experience it as a demotion.

The framing that helps: access is a function of current role, not of standing or trust. Nobody objects that they cannot access payroll; the objection arises when something is taken away, which is a transition problem rather than a principle problem.

Do it as a scheduled review applied to everyone, not as targeted removals. Universal application removes the implication.

The measurement

Number of people who can reach each sensitive category, tracked over time.

It is the only insider risk metric that reflects actual exposure rather than programme activity, and a downward trend means something real.