Digital identity and cybersecurity: understand your accounts and protect your access

You sign into a work tool, open a shared folder and discover you can see information you don’t need. Elsewhere, a message asks you to verify your account before it is suspended. Both situations involve digital identity, but they need different responses.

Digital identity helps a system recognise an account and decide what it can do. Cybersecurity protects systems and information from threats, including someone misusing that access. Understanding the connection helps you protect your accounts and ask better questions when working in tech.

What is digital identity?

A digital identity is the information that represents a person, organisation or software service within a system. For your work account, that might include a unique account identifier, your name, email address, team and assigned role. It does not have to include your legal name or a government identity document.

You can have several digital identities across different services. Your personal email account and your workplace account may represent the same person, but they have different owners, purposes and permissions. A digital footprint is related: it describes traces of online activity, such as posts and comments, rather than simply the account a system recognises.

Three questions behind account access

Identity and Access Management, usually shortened to IAM, brings together the processes and technology used to manage identities and permissions. Three concepts make it easier to understand:

Identification

Which account are you using?

Entering your username tells a service which account you want to use. A username identifies the account, but knowing it is not proof that you control it.

Authentication

Can you prove you control that account?

A password, passkey or another sign-in method provides evidence that you are entitled to use the account. This does not necessarily verify your real-world identity.

Authorisation

What is that account allowed to do?

Permissions determine whether you can read a document, change it, invite another user or delete a workspace. A successful sign-in does not automatically grant every permission.

These distinctions follow the core concepts in Microsoft’s introduction to identity and access management.

How identity becomes a cybersecurity issue

An attacker who takes over an account may be able to read private messages, change records or impersonate its owner. The impact depends partly on the permissions that account holds. Protecting sign-in and limiting access address different parts of the problem.

Phishing uses deceptive messages or websites to persuade someone to disclose information or take an unsafe action. Password reuse creates another opportunity: a password stolen from one service may work elsewhere. Inside organisations, unnecessary permissions and forgotten accounts can leave access available after it is needed.

Some digital identities belong to applications or automated services. For example, a reporting tool may have permission to read a database. That access also needs an owner, a clear purpose and a way to remove it. Identity security extends beyond human sign-ins.

An example: sharing a research folder

Consider this example. A team invites an external researcher to review interview notes. The researcher needs to read one approved folder for two weeks. They do not need access to the entire project workspace or the ability to manage membership.

Four decisions for the researcher’s access

Decision	Application in this example
Identify the account	Invite the researcher’s agreed account, rather than sharing a team login.
Protect sign-in	Use the organisation’s required authentication method.
Limit access	Grant read-only access to the approved folder; check inherited workspace permissions.
Plan removal	Record an owner and end date, then remove access when the work ends.

This applies the principle of least privilege: give an account the access it needs for its task. A strong sign-in method cannot compensate for granting access to the wrong information. Equally, a sensible permission level cannot stop someone using a stolen account within those permissions.

Make your own accounts harder to misuse

Choose passkeys where available

A passkey lets you sign in using a device’s unlock method, such as a fingerprint, face recognition or PIN. Passkeys are tied to the legitimate service, which makes them resistant to phishing.

The UK National Cyber Security Centre recommends passkeys wherever available. They do not remove every security risk.

Protect accounts that still use passwords

Use a unique password for each service and a password manager to generate and store them. For workplace accounts, use an approved tool.

Turn on two-step verification where supported. Protect your main email account carefully because it often receives password-reset messages for other services. Read the National Crime Agency’s advice.

Verify unexpected requests independently

If a message demands an urgent sign-in, open the official app or navigate to the service yourself. Check unusual workplace requests through a known contact route.

Do not share verification codes or approve a sign-in you did not initiate. Read the UK phishing guidance.

Check recovery and connected access

Keep recovery details current, protect recovery codes and review devices and applications connected to important accounts.

Understand how you would recover access if your phone were lost. Keep devices and applications updated.

If an account may already be compromised

Use the provider’s official recovery guidance, reached through its app or website. From a trusted device, change a compromised password and any reused copies, review recovery details and remove unfamiliar sessions or connections. For a work account, report the concern promptly through your organisation’s incident process. Follow the NCSC’s account-recovery guidance for the next steps.

Try a ten-minute access review

Choose one important personal account, or one work tool you are authorised to review. Write down:

Who owns the account or manages access?
How is sign-in protected?
What can the account read, change or delete?
Which devices or applications still have access?
How would access be recovered or removed?

Choose one improvement you can make safely, or send a specific access question to the tool’s owner. The useful result is a clearer understanding of who has access, what they can do and what needs attention.

For further reading: protecting business accounts and information.