Following my previous post, let\u00b4s talk money, because that is usually where the PAW discussion ends up.<\/p>\n
When an admin needs two devices, an extra logon and a few more minutes for each task, someone in management eventually does the math. Ten minutes a day for twenty admins is a lot of hours per year. Add the cost of the devices and the project, and the answer comes back: too expensive, let\u00b4s find something else.<\/p>\n
The problem is that the calculation only has one side. On the other side is the cost of an attacker getting domain admin, and that number is not ten minutes per day. It is weeks of downtime, rebuilt infrastructure, incident response consultants and sometimes a ransom. In the cases I have worked on it is often more than the entire IT budget for a year.<\/p>\n
Security will always cost some productivity. The question is where you pay it. Spend it on the few people with the keys to everything, the admins, and keep it as low as possible for everyone else. That is good prioritisation.<\/p>\n
What doesn\u00b4t work is asking everyone to be a little bit secure and nobody to be really secure.<\/p>\n
Ten minutes a day is cheap insurance. Ask anyone who has rebuilt an Active Directory.<\/p>\n","protected":false},"excerpt":{"rendered":"
Following my previous post, let\u00b4s talk money, because that is usually where the PAW discussion ends up. When an admin needs two devices, an extra logon and a few more minutes for each task, someone in management eventually does the math. Ten minutes a day for twenty admins is a lot of hours per year. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,12,4,13],"tags":[38,70,47],"class_list":["post-1224","post","type-post","status-publish","format-standard","hentry","category-business","category-methodology","category-security-architecture","category-technology","tag-business","tag-cost","tag-privileged-access"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1224","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1224"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1224\/revisions"}],"predecessor-version":[{"id":1252,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1224\/revisions\/1252"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1224"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1224"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1224"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}