Least Privilege Explained: Give Website Users the Access They Need

The six points in the video

This is a silent video. The headings, explanations and labels below reproduce the information on screen.

1. 1

   Step 1: Name the task first

   0:18

   Updating a paragraph and managing all users require different powers.

   On-screen labels: Content task; User management; Actual requirement.

2. 2

   Step 2: Choose a suitable role

   0:30

   Check what the role permits before assigning it.

   On-screen labels: Role description; Allowed actions; Relevant resources.

3. 3

   Step 3: Use separate named accounts

   0:42

   Individual accounts make access easier to review and remove.

   On-screen labels: Named person; Separate account; Clear owner.

4. 4

   Step 4: Limit temporary access

   0:54

   Agree when project access should be reviewed or removed.

   On-screen labels: Project purpose; Review date; Responsible owner.

5. 5

   Step 5: Check connected services too

   1:06

   Hosting, domains and integrations have their own permissions.

   On-screen labels: Hosting access; Domain access; Connected services.

6. 6

   Step 6: Review when the work changes

   1:18

   Remove permissions that are no longer needed.

   On-screen labels: Changed responsibilities; Finished project; Current access list.

Common questions

Go further