The permissions audit that found an over-broad group

How one question during a support case uncovered a group giving nearly all staff access to a whole site, and hit a device-removal milestone.

While working a support case with a vendor, I opened the permissions on a company intranet site and found something that did not look right: a single group was granting almost every member of staff view access to the entire site. Not a document, not a page. The whole thing.

It was not a breach. It was an over-broad default that had probably crept in over time and never been reviewed. But "everyone can see everything" is exactly the kind of finding that matters in an access review, and I flagged it and got it scoped down to the people who actually needed it.

That single moment is the best argument I can make for access reviews. Monitoring tells you when someone does something wrong. A permissions review tells you who could, and that includes the quiet, accidental over-exposure that no alert will ever fire on. The question that finds these is not "does this person need access?" It is "who should NOT have this access, and why do they have it anyway?"

The same week the endpoint removal project hit a milestone: fifty-seven devices confirmed uninstalled, with a forty-device confirmed-working list and a cross-check in the remote management tool to catch follow-ups. I also helped deliver a new-hire IT and security overview alongside a colleague.

I closed thirty-one tickets. But the permissions finding is the one I would put on a resume, because it shows how I think about access: least privilege is not a checkbox you set once. It is a question you keep asking, because the answer drifts.

If you manage a system, go look at who has the broadest access to it. That is almost always where the surprise is.

← All writing · Portfolio