Treat identity as the new perimeter
As services move online, accounts, not network location, decide who gets in. Strong identity management is therefore one of the highest-value investments a public body can make. The goal is simple: the right people have the right access, no more, and every account is protected and accountable.
Control access
Give each person a unique account; never share logins, especially for administration.
Apply least privilege and role-based access, and grant elevated rights only when needed.
Enforce multi-factor authentication everywhere, and prefer phishing-resistant methods for administrators.
Join and leave processes must grant access on hiring and remove it immediately when someone changes role or leaves.
Review access regularly and remove dormant and orphaned accounts.
Protect privileged accounts
Administrator and service accounts are the keys to everything, so attackers target them first. Separate day-to-day accounts from administrative ones, so email and web browsing never happen from a privileged login. Vault and rotate high-value credentials, limit where administration can be performed, and log and monitor privileged activity closely.
Make access auditable
Keep records of who has access to what and why, and ensure sign-in and administrative actions are logged to support investigation. When an incident occurs, being able to answer "who did this, from where, and when" turns a mystery into a manageable event.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.