Devices: Your admin´s laptop is the real Tier 0
May 14th, 2022 by Jesper Kråkhede
The third area from the privileged access strategy: devices.
There is a saying that I have repeated so many times that my family can quote it: The security of an account is never better than the security of the device it is used from.
Think about it. You can protect your Global Admin with the strongest authentication in the world. If the admin logs on from a laptop that also runs the browser, reads mail, has a few nice browser extensions and a game the kids installed, the attacker doesn´t need the password. He just waits on the laptop for the admin to log on.
That is why privileged access needs a privileged device. A PAW, a privileged access workstation. Locked down, no mail, no browsing except to the admin portals, only approved applications, everything managed from the cloud and monitored closely.
I know. Admins love their laptops more than their cars, and asking them to use a second machine is like asking them to drive a minivan. But it is the single most effective thing you can do to protect your admin accounts.
If two devices is a deal breaker, there are compromises. Make the PAW the main machine and run the everyday stuff in a virtual machine or a separate cloud desktop. Just never the other way around.
A secure account on an insecure device is a very expensive password.