What does an admin really cost?
Jul 16th, 2023 by Jesper Kråkhede
Following my post on SAWs, a business question: What does it actually cost to have someone with Global Admin or Domain Admin rights?
Most organisations only count the salary. But the real cost of a privileged admin, done properly, includes much more. A dedicated, hardened device in addition to the normal laptop. Licences for strong authentication, privileged identity management and monitoring. A separate admin account and the time spent switching between accounts and devices. Background checks and regular reviews of who has which rights. Training, so the admin knows how attacks work. And the share of the SOC´s time spent watching privileged activity.
Organisations like Microsoft have decided that this cost is worth paying, because the alternative is much worse. If one admin account in a large cloud service is compromised, the damage is enormous.
For most organisations, the math is the same, only smaller. The cost of protecting your few most privileged admins properly is small compared to what an attacker can do with their access. The problem is usually that the cost is visible in the budget, while the risk is not.
So for management: count how many people have the highest privileges. Then multiply by what it costs to protect them properly. If the number scares you, reduce the number of admins, not the protection.
Fewer admins, better protected, is always cheaper.