Lion Cipher Lab
Perform a quarterly access review
- GRC / Compliance
- Beginner
- ~50 min
- Free · no account required
Why it matters
Access is the thing attackers actually want: almost every breach ends with someone -- an outsider who stole a login, or an insider who kept access they should have lost -- reaching a system they were not supposed to reach. An access review (also called user access recertification) is the recurring control that closes that gap: on a schedule, usually every quarter, you list who can get into each system and at what level, then deliberately confirm each one is still needed and remove what is not. It matters because access does not clean itself up. People change roles, projects end, contractors…
What you'll learn
- what an access review (user access recertification) is and why it exists
- least privilege -- giving each person only the access their job needs
- privilege creep -- how access quietly piles up over time
- what an entitlement / privilege level is (view vs edit vs admin)
- orphaned and standing accounts, and why they are risky
- segregation of duties (SoD) and why one person should not hold conflicting access
- building an access-review worksheet (system, person, level, need, decision)
- deciding Keep / Reduce / Revoke with a written justification
- producing a dated, owned action list from a review
- recertification cadence and sign-off (attestation)
Steps in this lab
- What an access review is, and the one idea it runs on
- Why this is a required control -- and what auditors look for
- Open a spreadsheet and write your scope at the top
- List your systems -- the inventory you are reviewing against
- Build the worksheet columns -- the exact layout of a review
- Fill the worksheet -- who can reach each system, and at what level
- Establish need, then decide: Keep, Reduce, or Revoke
- Check for segregation-of-duties conflicts
- Produce the action list, then sign off and set the next date
- What you built, and the mindset to keep