1
10 steps
Most breaches start with a stolen identity, not an exploit. These steps harden authentication, privileges, and machine identities so a single phished password or leaked key cannot open the whole environment.
Require FIDO2 security keys or passkeys for administrators, remote access, and sensitive applications. Treat SMS and one-time codes as a fallback only, and block legacy authentication protocols that cannot do MFA at all.
Connect every application to a single identity provider over SAML or OIDC so MFA, conditional access, and offboarding apply in one place. Disable local application accounts except documented break-glass accounts.
Give administrators a dedicated privileged account that is never used for email or browsing, and require stronger authentication and managed devices for it.
Replace standing admin rights with time-limited elevation that requires approval and a reason. Record privileged sessions and review elevation logs regularly.
Provision and deprovision accounts from HR events using SCIM so leavers lose access the same day and movers do not keep old permissions.
Have system owners recertify who has access to their applications and data every quarter for privileged roles and at least twice a year for others. Remove access that is not confirmed.
Check new passwords against breached and common password lists, throttle failed attempts per account and per source, and avoid forced periodic rotation, in line with NIST SP 800-63B.
Use short-lived access tokens with refresh token rotation, shorter sessions for privileged apps, and automatic session revocation when risk signals change.
Inventory every service account, API key, and workload identity. Prefer workload identity federation over long-lived keys, scope each identity to a single purpose, and rotate any remaining secrets automatically.
Send identity provider logs to your SIEM and alert on impossible travel, MFA fatigue patterns, token reuse from new devices, new OAuth consent grants, and changes to privileged groups.