I have been talking about Privileged Access Workstations for years. Every customer agrees it is a good idea. Very few actually do it. Why?<\/p>\n
The honest answer is that it is a pain for the admins. Instead of one laptop they now need two, or at least a separate secure environment. They can\u00b4t read mail and manage servers from the same machine. They need separate accounts for each tier. Every time they want to do something quick they have to switch, logon again and maybe ask for elevated rights. It feels slow and annoying, and the admins are usually the most busy people in IT.<\/p>\n
So the projects stall. The PAWs get bought, a few admins use them for a while and then everyone slowly drifts back to doing everything from their normal laptop.<\/p>\n
There are ways to make it less painful. Make the PAW the admin\u00b4s main device and run the productivity stuff in a separate environment instead of the other way around. Use just in time rights so they don\u00b4t need to request access through a ticket for everything. Automate the routine tasks so fewer people need Tier 0 at all. And above all, start with the few accounts that really matter, the domain admins.<\/p>\n
The attackers will gladly use the shortcut your admins take. Make the secure way the easy way.<\/p>\n","protected":false},"excerpt":{"rendered":"
I have been talking about Privileged Access Workstations for years. Every customer agrees it is a good idea. Very few actually do it. Why? The honest answer is that it is a pain for the admins. Instead of one laptop they now need two, or at least a separate secure environment. They can\u00b4t read mail […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[12,4,13],"tags":[32,47,31],"class_list":["post-1223","post","type-post","status-publish","format-standard","hentry","category-methodology","category-security-architecture","category-technology","tag-paw","tag-privileged-access","tag-tier-model"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1223","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1223"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1223\/revisions"}],"predecessor-version":[{"id":1251,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1223\/revisions\/1251"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1223"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1223"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1223"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}