Cyber Security Access Control: Roles, MFA and Account Reviews
Access control determines who can use a resource and which actions they can perform. Authentication checks identity; authorization checks permissions. MFA strengthens authentication, but an account with MFA can still have excessive access.
This exercise uses a fictional training company and a shared project folder. You can complete the review in a spreadsheet or a local lab using test accounts. It does not require access to an employer’s systems.
Start with the access requirement
| Role | Required access | Should not receive |
|---|---|---|
| Learner | Read course materials; edit their own submissions. | Edit another learner’s submission or change roles. |
| Trainer | Review submissions and publish course materials. | Unrelated payroll records or platform administration. |
| Administrator | Manage account configuration when required. | Unrestricted daily use of privileged access without a work reason. |
Least privilege means granting the access needed for the task. The OWASP Authorization Cheat Sheet recommends denying access by default and validating permissions on each request. A hidden menu button is not an authorization control.
Review a fictional account list
learner-a | role=trainer | owner=current learner | MFA=enabled trainer-b | role=trainer | owner=current trainer | MFA=enabled temp-c | role=admin | owner=contract ended | MFA=unknown
learner-a: the role does not match the stated need. Verify the approved access request with the resource owner, then propose the appropriate learner role. MFA does not resolve this permission mismatch.
trainer-b: the role appears consistent with the stated work. Still check the actual permission scope and owner approval; a role name alone cannot prove access is correct.
temp-c: an expired engagement and privileged role need review. Check whether the account owns scheduled tasks or other dependencies. Route removal through the approved offboarding process and record the responsible owner.
A repeatable account-review workflow
- Inventory the account, owner, role, resources, last-use context and expiry where available.
- Compare effective access with the current business need.
- Ask the resource owner to approve retention, reduction or removal.
- Apply the approved change through the authorized administrator.
- Test permitted and denied actions using controlled accounts.
- Record evidence, reviewer, change reference and the next review date.
Review both direct permissions and group membership. Removing one direct grant may leave the same access available through another group. For sensitive changes, prepare the approved recovery or rollback route before the change.
Where MFA fits
MFA uses distinct authentication factors, rather than two passwords. Recovery and factor-reset processes also need care: if those routes are weak, a strong login screen does not solve the whole problem. See the OWASP MFA Cheat Sheet for implementation considerations.
Keep MFA status separate from permission review in your worksheet. You need to answer both: can the service establish the user’s identity, and should that identity be allowed to perform this action?
What to include in your portfolio
Save the fictional access matrix, three review decisions and before/after verification. Include one allowed action and one denied action for a learner account. State that this is a simulated account review, and remove passwords, recovery codes and tokens from screenshots.
Use the log-analysis exercise to connect access decisions with recorded events and the home-lab guide to plan isolated test accounts.
Continue learning
For guided networking, Linux, security labs and SOC practice, see Cyber Security Training in Vizag. Softenant offers the 3-month course for Rs. 15,000, with classroom and online batch options.