Interfaces: Every console is a front door
Jul 9th, 2022 by Jesper Kråkhede
The fifth and last area I´ll cover from the privileged access strategy: interfaces. The consoles, portals, APIs and tools that admins and applications use to manage things.
A modern environment has a frightening number of them. The Azure portal, the Microsoft 365 admin center, PowerShell, the Graph API, the management console for the firewall, the hypervisor, the backup system, the EDR. Plus a SaaS app or ten with their own admin pages.
Each one is a front door. And here comes the funny part. Many companies have put a solid steel door on the main entrance, with second factors and Conditional Access, and left the side doors with a simple lock. The backup console with a local account. The hypervisor management with a shared password. The API that uses an app registration with a client secret from 2019, stored in a script on a file share.
Guess which door the attackers use?
The strategy says to protect every interface at the level of what it controls. Put the admin interfaces behind the identity platform where you can, so the same rules apply. Turn off local accounts where possible. Review the app registrations and service principals, they are admins too. And log every admin action, wherever it happens.
A house is only as secure as its least protected door.