Roles and least privilege

Most website platforms and online services have roles: administrator, editor, author, viewer. A role decides what a person can do. When everyone is an administrator, any one stolen password, or any one mistake, can do the most damage possible.

The principle is called least privilege. CISA's Cybersecurity Performance Goals put it this way: all user accounts, system roles and processes operate with the minimum privileges necessary to perform their tasks (goal 3.H).

Roles in a typical website

WordPress, which runs many public sites, has five default roles:

• Administrator: everything, including installing plugins, changing settings and managing users.
• Editor: publishes and manages all content, including other people's.
• Author: publishes and manages their own content.
• Contributor: writes and edits their own drafts, but cannot publish.
• Subscriber: manages only their own profile.

Multisite installations add a Super Admin above Administrator. Drupal and other systems let administrators define their own roles, often named Content Editor or Site Manager. The idea is the same.

Match the role to the job

• The web owner and one backup: Administrator.
• Communications staff who manage the whole site's content: Editor.
• A department editor who maintains their own pages: Author, or a custom role limited to their section if your system supports it.
• Someone who drafts and needs review: Contributor.
• A vendor: only the role their task needs, for as long as they need it. Lesson 5 covers vendors.

The same pattern applies outside the website. On social media, give most people a role that can post but not add or remove other people. At the registrar, only two people need access at all.

Keep administrators few

At least two people should hold the administrator role on every critical account, so the institution is never locked out. Beyond that, each additional administrator is another login that can install software, delete content, change who has access or turn off security settings. Ask "who needs to do that, and how often?"

A separate login for administrator work

CISA's goal 3.G says administrators maintain separate user and privileged accounts. In practice, for a small office:

• Your everyday website login is an Editor, used for routine publishing.
• Your administrator login is separate, with its own strong password and two-step sign-in, used only for settings, plugins and user changes.

If your everyday password is phished, the attacker gets an Editor's access, not an Administrator's.

Change default passwords

New systems often arrive with a default administrator password: routers, camera systems, meeting room equipment, some website installers. CISA's goal 3.A calls for changing default manufacturer passwords. Change them on day one, and record the account in your inventory.

Review roles now

Open the user list of your website. For each person, ask:

1. Do they still work here, or still work with us?
2. Do they still need access at all?
3. Is their role the smallest that fits their job?

Lower roles that are too high. Remove people who no longer need access. Lesson 6 makes this a quarterly habit.