Next area from the privileged access strategy: accounts.<\/p>\n
I did an informal survey at a customer recently. I asked everyone in the IT department who thought they needed Global Admin to raise their hand. Eleven hands. Then I asked who had used it in the last month for something that actually required Global Admin. Two hands, and one of them was a bit unsure.<\/p>\n
Here is the thing. Every privileged account is a target. Every standing permission is a permission an attacker can use the moment he steals the password. So the rules are simple, even if they are not popular.<\/p>\n
Separate accounts for admin work. Your normal account reads mail and browses the internet. Your admin account does neither. Ever.<\/p>\n
No standing rights. Use Privileged Identity Management so the role is activated when needed, for a limited time, with a reason and maybe an approval. When the job is done, the right expires by itself.<\/p>\n
Least privilege. There are a lot of roles that are not Global Admin. Use them. Most tasks can be done with something much smaller.<\/p>\n
Strong authentication. A second factor that can\u00b4t be phished, preferably a hardware key or Windows Hello for Business.<\/p>\n
And keep two break glass accounts, excluded from everything, monitored around the clock.<\/p>\n
Eleven Global Admins is not a team. It is an attack surface.<\/p>\n","protected":false},"excerpt":{"rendered":"
Next area from the privileged access strategy: accounts. I did an informal survey at a customer recently. I asked everyone in the IT department who thought they needed Global Admin to raise their hand. Eleven hands. Then I asked who had used it in the last month for something that actually required Global Admin. Two […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[103,104,47,102],"class_list":["post-1315","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-accounts","tag-pim","tag-privileged-access","tag-spa"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1315","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1315"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1315\/revisions"}],"predecessor-version":[{"id":1344,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1315\/revisions\/1344"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1315"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1315"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1315"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}