The organisation behind privileged access
Jul 20th, 2022 by Jesper Kråkhede
Over five months I have gone through the enterprise access model, accounts, devices, intermediaries and interfaces. Let me end with the organisation that is needed to pull it off.
Securing privileged access is not a project with an end date. It is a capability you build and maintain. That needs a few things in place.
An owner with a mandate across all teams and all platforms, on-premises and in the cloud. A small team that designs the model, runs the PAW service and keeps track of all privileged accounts, devices, intermediaries and interfaces. Clear processes for granting, reviewing and removing privileged access, with management backing when someone wants an exception. Contracts with service providers that make them part of the model. Metrics reported to management regularly. And a link to the SOC, so that unusual privileged activity is detected and acted on quickly.
None of this is expensive compared to the risk. In almost every major incident I have worked on, the attacker went for privileged access, because that is what turns a small breach into a disaster.
Microsoft´s rapid modernization plan in the same strategy is a good place to start. It lists the quick wins in a sensible order.
Protect the few accounts that can destroy everything. Everything else gets a lot easier.