Access management means knowing who can get into which tool, and being able to remove that access the same day. Still, it is not a big-company topic. It is what keeps a stranger from changing your systems without you knowing.

In fact, we lived it last week with a client. An automation we had set up in December had started sending messages on dates nobody had planned.

Access management: the story of the unknown user ID

The client calls us because a seasonal automation no longer does what we set up. So we open the version history. Our last change is dated December 9, according to the history. Then, on May 6 and 7, someone else went in.

Someone, yes, but who? The history shows a user ID, a string of characters, not a name. Next, we dig through emails, cross-check dates, search. Finally, the most likely explanation: a former team member, gone for months, whose account was never closed.

However, the change itself was not malicious. She had simply added new send dates. In fact, the problem was that a person who no longer worked there still had her hands on the system, and nobody knew.

Why access management goes wrong in a small business

Access management goes wrong because it happens at the entrance and never at the exit. You create accounts when someone arrives. Then you forget to close them when the person leaves.

Yet in a small business, departures are rarely clean. An intern finishes her contract on a Friday. A contractor delivers his project and moves on. A partner leaves the venture. In that moment, the urgency is keeping the work going, not closing accounts.

For example, the Canadian Centre for Cyber Security says it in its baseline controls for small organizations: each user should have a unique individual account, and there should be a process to revoke accounts when they are no longer required, such as when employees leave. Simple on paper. Still, almost never done.

The shared account, enemy number one

The shared account makes any access management impossible. Because when three people use the same login, the history tells you someone did it, never who.

Of course, the reflex is understandable. Paying for one more seat costs money, and passing the password around is faster. But the day one person leaves, you cannot close her access without cutting off the other two. So you do nothing, and she keeps the door open.

Hand removing a key from a key ring in front of an office door, a picture of access management

Then, when a change causes a problem, as it did with our client, you cannot even know who to ask. In other words, one account per person is what makes the history useful.

Access management in four moves

Access management that holds up in a small business does not require an IT department. Instead, it requires a list and four moves.

  • First, take inventory. One table: tool, person, level of rights. One hour of work, once.
  • Then, one account per person. Delete shared accounts, even if it costs a few dollars more per month.
  • Also, give the minimum. The person who writes the emails does not need the power to delete an automation.
  • Finally, close on departure day. Add a line that says remove access to your offboarding list, right next to collect the keys.

For example, with the client in this story, the fix took fifteen minutes once the culprit was identified: close the account, then check the three other tools where that person also had access.

What the version history teaches you

The version history is your best ally for access management, as long as you read it before things break. Because it tells you who touched what, and when.

So take one hour per quarter. Open your main tools and look at who logged in recently. An account that has not logged in for six months is an account to close. And an unknown account is an account to close right now.

We already told the story of how a green light can lie about the real state of an automation. Likewise, the forgotten access is that green light’s cousin: everything seems to work, until the day someone else decides what your system does.

Ask yourself this question tonight

If a person who left a year ago logged into your tools tomorrow, would you know? If not, your access management starts with the inventory.

And if you want us to do it with you, write to us.

Frequently asked questions

What is access management in a small business?

Access management means knowing at all times who can get into which tool, with which rights, and removing that access the day the person no longer needs it. One account per person, never a shared account.

What should you do when an employee or contractor leaves?

Remove their access the same day, tool by tool, from your list. Then change the passwords on the few shared accounts that still exist. The next day is already late.

How do you know who changed what in your tools?

Most tools keep a version history or an activity log. It only helps if each person has their own account. With a shared account, the history tells you someone did it, never who.

Terry Vilver, co-founder of Meriaky

About the author

Terry Vilver · Co-founder of Meriaky

A computer engineer with 5 years of experience between EDF (France’s national electricity provider) and Meriaky. At EDF, he built a ticketing system that automatically assigns customer files to the right operators. For the past 2 years at Meriaky, he has been helping small business owners free themselves from repetitive tasks: client follow-up runs automatically, and they save time and money.

His LinkedIn profile