Showing 1–6 of 6 articles
When your system acts with the wrong person’s authority
A service may have more access than the person asking it to act. It must check the caller’s authority before using its own powerful identity on that person’s behalf.
Read the visual guide
Account recovery that can walk around the second check
Strong sign-in protection can be undermined by a weaker recovery process. Review every way to regain access, including support-assisted changes and replacement recovery details.
Read the visual guide
How a support desk should handle a caller who sounds legitimate
Knowing an employee’s name, manager, or urgent problem does not prove identity. Use an approved verification process before resetting access or changing recovery details.
Read the visual guide
How to remove access when someone leaves
A person’s access may extend beyond their main account. Use a planned sequence to protect information, close sessions and tokens, and transfer legitimate ownership without losing critical work.
Read the visual guide
Who can send mail as the company
Your domain may appear in messages from staff, marketing tools, websites, and finance services. Record each sender and connect it to an owner and an intended authentication setup.
Read the visual guide
Practical zero trust: verify access to each important service
For a small team, zero trust starts with explicit access decisions around important services. Identity, device context, least privilege, and review matter more than adopting a label.
Read the visual guide