Admins are people too
Apr 15th, 2022 by Jesper Kråkhede
In my previous post I wrote about cutting down the number of admin accounts. This post is for the managers who will receive the complaints.
Because there will be complaints. ‘I can´t do my job without Global Admin.’ ‘It takes too long to activate the role.’ ‘The approval process blocks us at night.’ Some of them will be fair.
The organisation needs to handle this properly. Explain why, not just what. Most admins understand the risk once they see how an attack actually works. Involve them in designing the new processes, so the approvals and activations fit the way they work. Make sure there is always someone who can approve, including at night and during vacations, otherwise people will find ways around it.
And measure the right things. Don´t measure how quickly admins can do something with unlimited rights. Measure how many privileged accounts you have, how many are protected and how many standing rights are left.
Finally, reward the admins who do it right. Security culture starts with the people who have the most power, and it is a lot easier to lead by example when the example is recognised.
Admins are your strongest defenders and your biggest risk. Treat them like both.