Free course · Module 2 · Lesson 1 of 4
Who can get in
What you'll decide
Which accounts exist in your business, who holds them, who has admin rights, and what happens to an account the day its owner leaves.
Security people call it identity. For a small business it's a simpler question: who can log in to your stuff? Every person who ever got a login is a door into the business, and the doors don't close by themselves when the person leaves.
Plain-English terms
Account. A login: a username and password, usually with an email address attached. One person can have many accounts, one for each app or service.
Admin. Short for administrator. An account that can change settings, add or remove other users, and see everyone's data. Admin accounts are the keys to the building.
Shared login. One account several people use, like the password for the company's Instagram, the website, or the alarm company's portal. Usually on a sticky note or in a group chat.
Two-step login. Also called MFA or two-factor. After the password, the service asks for a code from your phone. A stolen password alone stops working.
Offboarding. Everything that should happen to someone's access the day they leave.
Accounts outlive people
The office manager leaves in March. Her computer login gets switched off, because the IT provider handles computers. Her Microsoft 365 account stays on, because nobody asked. She still knows the password to the company Instagram and the alarm portal, because those were never hers to begin with, just shared.
Nothing bad happens for months. Then her old email password turns up in a leak from some unrelated website, because she used the same one there. Someone tries it on your Microsoft 365 login. It works, there's no two-step login, and now a stranger is reading your invoices and learning who your suppliers are.
None of that took a skilled attacker. It took an account that outlived the person, and a password used twice.
Where the list already exists
You don't have to build this list from memory. It's already in four places.
Your email admin console
Microsoft 365: the admin center, under Users. Google Workspace: the Admin console, under Users. This is the closest thing to a master list your business has. It shows every account, who's an admin, and whether two-step login is on.
Bank, payroll and card portals
Each has its own list of users, and it's often out of date. The bookkeeper who left may still be a user on the payroll site.
Your IT provider
Ask for the list of accounts they manage for you, including their own. If they have an admin account in your Microsoft 365 or Google Workspace, it goes on your list too.
The sticky notes
Shared logins live outside any console: social media, the website, the domain registrar, the alarm company, the online store. Ask around. Every one is an account, and everyone who knows the password holds it.
What to record for each person
Three things, and they're the three columns that matter most on the tab you're about to fill in:
- Are they still here? Current or left. For anyone who left, whether their access was actually removed.
- Are they an admin anywhere? Email, the bank, the payroll site, the website.
- Is two-step login on? For their email account at least.
Plus one more: which shared logins do they know? That's the column that tells you what to reset when someone leaves.
Two admins is plenty
Most businesses need two admin accounts on their email system: one for the owner and one for the IT provider. Everyone else uses a normal account, and that includes the owner for daily email. An admin account that reads email all day is an admin account that clicks on things all day. Ask your IT provider for a separate admin login you use only when you need it.
Scenario
The office manager left in March
Dana left in March, on good terms. Your IT provider switched off her computer login that week. It's now June, and while going through the Microsoft 365 user list for this lesson you notice her account is still active. She also knew the shared passwords for the company Instagram and the alarm company's portal.
What do you ask your IT provider to do?
Pick the one you would choose. It opens with the reasoning, then you can compare the rest.
ADelete her account today.
Deleting is final, and her mailbox probably holds supplier emails and files other people still need. It also does nothing about the shared passwords she knows. Block the sign-in first, keep the mailbox for a while, and deal with the shared logins separately.
BBlock her sign-in today, remove any admin rights, forward her mail to her replacement, keep the mailbox for 30 days, then delete it. And reset the Instagram and alarm portal passwords.
That's the full offboarding: her access stops today, nothing is lost, and the shared logins she knows are no use to anyone anymore. It's also the routine you want in place before the next person leaves, so it happens the same day, not three months later.
CChange her password and keep using her mailbox as a shared inbox.
Now you have a shared login where you used to have a personal one, and the people who know the new password aren't written down anywhere. If you need a shared inbox, create one on purpose, with named people who can open it.
DNothing. Dana was trustworthy.
She probably was. Attackers don't need Dana. They need her old password to turn up in a leak from some other website, and an active account nobody watches to try it on.
Remember
- Every login is a door, and doors don't close when people leave. Offboarding has to be a routine, done the same day.
- The master list already exists in your email admin console. Bank, payroll and card portals have their own lists.
- Record three things per person: still here, admin anywhere, two-step on. Two admins is plenty.
Build your file
Tab 1: People and accounts
If you haven't yet, download your What We Have file and save it somewhere private, like your own OneDrive or Google Drive folder. You'll fill one tab per lesson.
Open the People and accounts tab. Add one row for every person who has, or had in the last year, a login to anything in the business. Include your IT provider. For each: role, whether they're current or have left, admin rights, two-step login, the shared logins they know, and for anyone who left, whether access was removed. Type over the grey example row or delete it.
The Read me tab counts people who left with access still in place. That number should be zero by the end of the week.
Where this goes next
Steps 2 and 15 of the Security Starter are the two halves of this lesson: remove access people no longer need, and make offboarding a same-day routine. In the VM Program Kit, identity systems are Tier 0, crown jewels, in the VM Policy's asset tiers.