Why User Access Controls Should be the First Priority in Cybersecurity