Who owns the keys to the kingdom?
Mar 25th, 2022 by Jesper Kråkhede
Following my post on the enterprise access model, a word to management about the organisation behind it.
Securing privileged access is not something IT can do on its own. It changes how admins work, who is allowed to do what and how fast certain things can be done. That means it needs decisions that only management can make.
First, someone must own it. Not the network team, not the server team, not the cloud team. One owner for privileged access across the whole environment, with the mandate to set rules that apply to everyone.
Second, it needs to be sponsored from the top. When the admins complain that the new way of working is slower, and they will, management must back the change instead of granting exceptions.
Third, the service providers must be part of it. If your outsourcing partner has admin access to your control plane, their accounts and devices are part of your enterprise access model whether they like it or not. Put it in the contract.
And finally, it needs follow-up. How many accounts have privileged access? How many of them are protected? Ask for the numbers every quarter.
Technology can protect the keys. Only the organisation can decide who gets them.