When budgets are limited, organizations face a difficult choice about whose accounts to protect first. Some start with the CEO and follow the corporate hierarchy, while others prioritize accountants, database administrators, and developers who directly handle critical data. The key is to base decisions on actual business risks rather than intuition or job titles.
Four Scenarios That Dictate Protection Priorities
There is no universal answer to the question of where to begin. Companies differ too much in their operations and threat landscapes. Instead, four typical situations show clear logic for setting priorities.
First scenario: protecting the network perimeter. When the main threat is unauthorized entry through VPN, every account with remote access must be secured. Once inside the local network, an attacker can reach critical systems. However, some VPN configurations limit users to specific resources such as 1C, while others grant broad internal network access. In the narrower case, risk is lower and enhanced authentication can be applied selectively.
Second scenario: protecting data in email and documents. When sensitive information resides mainly in email and files rather than infrastructure, protection focuses on these channels. This includes two-factor authentication for all staff, phishing email filtering, and control over attachments and links. Such measures close the primary attack vector even if infrastructure security remains minimal. Kontur Egida ID supports protection for Outlook Web Access, Exchange, ActiveSync, and ADFS, covering the main entry points to email infrastructure.
Third scenario: unique user cases. Some roles require individual assessment. A CEO who travels frequently and works offline needs laptop protection that functions without internet. An analyst handling large volumes of personal data requires workstation hardening and encrypted transmission channels. These situations demand evaluation of what the employee does, what data they access, and under what conditions.
Fourth scenario: contractors. External specialists receive accounts that are often marked as untrusted and must use second-factor authentication. In an incident, the contractor may deny involvement, but confirmation of login via the second factor from a specific device provides clear attribution. Kontur Egida allows two-factor authentication to be enabled through a simple email invitation, keeping the process straightforward.
Protection Matrix: From Goal to Means
A systematic approach starts with the asset to be protected and then selects appropriate tools. The matrix below illustrates this logic:
- Commercial information and finance – protected against theft and leakage using access control, encryption, and DLP systems.
- Infrastructure access (VPN) – protected against unauthorized entry using enhanced authentication and 2FA.
- Email and documents – protected against phishing and interception using 2FA and anti-phishing solutions.
- Privileged accounts (administrators, CI/CD) – protected against compromise using PAM systems, just-in-time access, and continuous monitoring.
Each row represents a distinct scenario with its own threat model. Tools must match the threat, not the other way around. Even the most expensive solution delivers value only when logs and alerts are regularly analyzed.
How to Evaluate Whether Protection Is Effective
Measuring effectiveness is challenging because few organizations publish internal metrics. Useful indicators include reduction in successful attacks or suspicious events, user feedback on usability and false positives, and the system’s ability to detect anomalies such as logins outside working hours or from unusual devices.
Three Common Mistakes When Building Protection
Mistake 1: Treating purchase and installation as the finish line. Value emerges only after ongoing log analysis and policy tuning. One administrator detected repeated login attempts against privileged accounts immediately after enabling two-factor authentication and blocked the attacking IP before damage occurred.
Mistake 2: Underestimating pilot preparation. In larger organizations, coordination across network, system, and security teams, plus testing windows, can extend timelines. Planning for both technical and organizational time prevents months-long delays.
Mistake 3: Trying to protect everyone at once. Limited resources make this unrealistic. Starting with the most critical accounts and expanding gradually is more effective.
Where to Start Tomorrow
The correct priority emerges from answering one question: what happens to the business if this account is compromised? Practical first steps include compiling a complete inventory of accounts, disabling unused entries from former employees or test environments, enabling two-factor authentication for users with access to databases and release systems, and expanding coverage in stages. Account protection is an ongoing process that requires continuous attention and refinement.
