2 Accounts and Permissions

Accounts identify users and define access

A User account represents a person or service that can sign in to a device, application, or network. It helps the system identify who is requesting access. Permissions define what that account can do, including whether it can view or edit a file, install software, or change system settings.

Choose the appropriate account type

A Standard account is intended for everyday activities such as browsing the web, using email, and working with documents. An Administrator account can make system-wide changes, including installing software or changing security settings. Because administrator access can affect an entire device, use it only when needed, rather than for routine work.

On Windows, User Account Control (UAC) can ask for approval or administrator credentials before an action is elevated.

Apply least privilege

The Principle of least privilege means giving each person or service only the access needed for its assigned tasks, and no more. Limiting access reduces the potential harm if an account is misused or compromised. This principle applies to programs and automated services as well as people.

For example, a staff member who only needs to read project files should receive read access, not permission to edit or delete them. Someone who installs software can use a standard account for everyday work and obtain administrator approval only for the installation.

Assign and review access

Permissions can be assigned directly to individual accounts or through Groups. For example, one team group could have permission to read a shared folder, while a smaller group could have permission to edit it. Group-based access can make permissions easier to manage, but group membership still needs to be appropriate and reviewed.

Use individual accounts when possible so activity can be tied to the right person. Grant access through suitable roles or groups, and limit it to the resources and tasks required. Review account and group access periodically, remove permissions that are no longer needed, and disable or remove accounts that are no longer required, such as when someone leaves an organization.

Protect accounts and separate sensitive duties

Protect sign-in credentials and use Multifactor authentication when available. Do not approve an unexpected permission or administrator prompt without checking what it is requesting.

Separate sensitive duties where practical. For example, avoid giving one person unnecessary control over both making a change and reviewing it. Together, individual accounts, appropriate group access, least privilege, and regular access reviews help manage accounts and enforce access rules.

• Separation of duties