The Myth of the Locked Door

We’ve been told for a decade that the biggest threat to our data is some sophisticated entity in a distant time zone. We spend our limited budgets on firewalls, encrypted backups and passwords that change every ninety days. We treat the perimeter like a fortress.

The news this week suggests we're guarding the wrong door.

While Poland is currently reeling from a healthcare breach affecting nearly 19 million people, that’s a systemic failure of scale. For the small firm, the real danger isn't always the massive heist. It's the quiet snoop. The SEC just flagged a case where a compliance officer’s partner traded on non-public deal info. That wasn't a hack; it was a conversation at the dinner table.

The conventional wisdom says you secure your data by "simply implementing" an Identity and Access Management (IAM) suite. I hate that phrase. For a ten-person shop, a fancy IAM tool is just another monthly subscription that nobody knows how to configure. It gives you a false sense of security while the actual permissions remain wide open because the admin hasn't touched the settings since 2023.

The real risk isn't the lack of software; it's the abundance of trust.

Most small firms operate on a "everyone needs everything" basis to avoid friction. You give the office manager access to the payroll, the accountant access to the client files and the lead dev access to the production database. Then you assume that because they’re "good people," they won't look at things they shouldn't.

That trust is a liability.

The Privacy Commissioner has recently suggested that when people unauthorizedly access personal data, their identities should be disclosed to the victims. This turns internal snooping from a quiet HR awkwardness into a legal nightmare for the firm. If your employee looks up a celebrity’s medical record or a neighbor's balance, you aren't just dealing with a rogue staffer; you're dealing with a breach of duty.

The strongest objection here is that strict access controls kill productivity. "I can't wait for an admin to grant me permission every time I need a file," the argument goes.

True. But friction is actually a feature, not a bug. If it takes three minutes to request access to a sensitive folder, people only do it when they actually need to. That creates a natural audit trail.

The second-order effect here hits your insurance and your auditors. When an insurer sees that every single employee had "Super User" permissions on your main database, they don't see a collaborative culture. They see systemic negligence. If you have a leak and it turns out you didn't bother with basic least-privilege access, the payout might be smaller or the premium hike significantly higher.

You don't need an enterprise software suite to fix this. You need a spreadsheet and some backbone. List every sensitive folder or database you own in column A. List every employee in column B. Put an 'X' where they actually *need* access. Then, go into your settings and delete everyone else. It’s boring, it’s tedious and your staff will complain for exactly two days.

It costs nothing but time.

Check the permissions on your most sensitive client folder this Friday. If anyone in there doesn't have a daily business reason to be there, boot them out.