Access control and strong authentication

Access control is the single most visible part of an ISMS in most people's working day, and two principles drive almost all of it.

Least privilege

People should have the minimum access they need to do their job, and no more. Not because anyone distrusts you personally, but because every account is a target. If your account is compromised through a phishing email or a stolen password, the attacker gets exactly what you had access to. The less that is, the smaller the blast radius. Least privilege is also why access is reviewed periodically and removed when people change roles: access should track what you need now, not what you have ever needed.

The practical implications for you:

• Request access through the proper process, and only for what you need
• Never share your account or password with anyone, including colleagues and IT staff
• Never use someone else's login, even with their permission, because shared credentials destroy accountability
• Tell IT or your manager if you notice you still have access to something you no longer need

That last one is worth underlining. Flagging your own excess access is exactly the behaviour a healthy ISMS depends on.

Strong authentication

Passwords on their own are a weak defence: they get guessed, reused, phished, and leaked. Modern practice, and your organisation's policy, will typically require some combination of the following.

• Long, unique passwords or passphrases, never reused between work and personal accounts
• A password manager where approved, rather than notebooks or spreadsheets of passwords
• Multi-factor authentication (MFA), which asks for something extra beyond the password, such as an authenticator app prompt or a hardware key

MFA deserves special respect because it is one of the most effective controls available against account takeover. Two cautions: never approve an MFA prompt you did not trigger, and treat a stream of unexpected prompts as an attack in progress, not an annoyance. Someone has your password and is trying to get past the second factor. Report it immediately.