What is a SAW?
Jul 14th, 2023 by Jesper Kråkhede
I often get asked how Microsoft itself protects its admins. Part of the answer is public, and it has a name: SAW, Secure Admin Workstation.
Microsoft has described SAWs in public material for several years. The idea is the same as the PAW I have written about for a long time, taken quite far. Engineers who administer high value systems, like production cloud services, do it from a dedicated, locked down device. The device is used only for that work. No mail, no general web browsing, no personal applications. Only approved software is allowed to run. The device is managed and monitored centrally, and access to the sensitive environments is only allowed from these devices.
Combined with strong authentication, just in time access and separate admin accounts, it means that even if an engineer´s normal laptop is compromised, the attacker can´t use it to reach production. He would need to compromise the SAW, which is a much harder target.
Is this realistic for everyone? In full, probably not. It needs hardware, people to build and run it and a culture where admins accept the restrictions. But the principle scales down. Even a small organisation can give its few most important admins a separate, hardened device.
If Microsoft considers it necessary for its own admins, it is worth considering for yours.