Accounts: Do you really need to be Global Admin?
Apr 5th, 2022 by Jesper Kråkhede
Next area from the privileged access strategy: accounts.
I did an informal survey at a customer recently. I asked everyone in the IT department who thought they needed Global Admin to raise their hand. Eleven hands. Then I asked who had used it in the last month for something that actually required Global Admin. Two hands, and one of them was a bit unsure.
Here is the thing. Every privileged account is a target. Every standing permission is a permission an attacker can use the moment he steals the password. So the rules are simple, even if they are not popular.
Separate accounts for admin work. Your normal account reads mail and browses the internet. Your admin account does neither. Ever.
No standing rights. Use Privileged Identity Management so the role is activated when needed, for a limited time, with a reason and maybe an approval. When the job is done, the right expires by itself.
Least privilege. There are a lot of roles that are not Global Admin. Use them. Most tasks can be done with something much smaller.
Strong authentication. A second factor that can´t be phished, preferably a hardware key or Windows Hello for Business.
And keep two break glass accounts, excluded from everything, monitored around the clock.
Eleven Global Admins is not a team. It is an attack surface.