#least privilege

In der GitHub-Oberfläche steht neben jedem Team eine Rolle: Read, Write, Admin. Das ist die nominale Zuweisung, also das, was jemand laut Konfiguration bekommen soll. Was eine einzelne Person am Ende tatsächlich darf, steht dort nicht. Effektive Rechte entstehen aus mehreren Quellen gleichzeitig, und bei Konflikten gewinnt immer die höchste. Wer nur auf die Team-Liste schaut, sieht die Absicht,…

In den meisten GitHub-Organisationen kennt niemand mehr die vollständige Antwort auf eine einfache Frage: Wer hat gerade Zugriff worauf, und warum. Rechte werden vergeben, wenn jemand sie braucht. Zurückgenommen werden sie fast nie. Das Ergebnis ist ein stiller Rechte-Berg, der mit jedem Onboarding, jedem Projekt und jedem externen Dienstleister weiter wächst. Rechte wachsen, aber niemand nimmt…

Die meisten CI/CD-Pipelines laufen mit weit mehr Rechten, als sie für ihre Arbeit brauchen. Ein Job, der nur Tests ausführt, hat plötzlich Schreibzugriff auf das Repository, kann Releases anlegen und liest jedes Secret im Projekt. Niemand hat das so geplant. Es ist über die Zeit gewachsen, weil ein breiter Token einfacher war als ein passgenauer. Genau hier setzt Least Privilege an: Jeder Schritt…

Photo by Andrea Piacquadio on Pexels.com Active Directory is a directory service that manages user accounts and other resources on a network. It is important to secure Active Directory user accounts to prevent unauthorized access, data breaches, and identity theft. In this blog post, we will describe the step-by-step process to secure Active Directory user accounts using best practices and…

Active Directory (AD) is a directory service that manages the identities and access rights of users and devices in a network. AD security settings are the policies and configurations that define how AD objects, such as users, groups, computers, and organizational units, are protected from unauthorized access or modification. AD security settings are essential for any organization that uses AD as…

As we open 2019, we are expecting the issue of least privilege cybersecurity to become a priority for companies across the spectrum. One of the big reasons, of course, is that 80 percent of breaches today involve the compromise of IT and business user credentials including usernames and passwords.  To combat the exploitation of compromised accounts, organizations increasingly recognize how important it is to secure and protect privileged access across the enterprise for super users and business users, services, applications, data and systems.

The concept of least privilege cybersecurity has come to the forefront because it offers a means to proactively make sure that when credentials are hacked or abused (and we should assume they will be sooner or later), privileges are restricted or limited so that any exploitation can be quickly detected and contained.  This is particularly important in securing hundreds or even thousands of vulnerable endpoints.  However, restricting privileged access poses significant challenges that must be addressed.

How do we prevent overprivileged access without negatively impacting productivity?

If users can’t get access to an account, server or device such as a printer or application, they will have to call the helpdesk. Helpdesk staff, under pressure to keep things running, all too often end up granting more privileges than needed to get users quickly back on track.  The dilemma becomes:  How do we prevent overprivileged access by users, applications and services without negatively impacting productivity?

To help organizations understand the principle of least privilege and how to successfully implement a least privilege strategy, I’ve just authored a new eBook, published by Thycotic called Least Privilege Cybersecurity for Dummies.

Much like the previous two “Dummies” books that I’ve authored (PAM for Dummies, Cybersecurity for Dummies), this new book gives you an easily readable 16-page introduction to least privilege cybersecurity that you can share with your IT staff as well as business users and executives.

Learn the five key action steps to help assure success in implementing least privilege

The book explains how to define least privilege cybersecurity, with examples to illustrate the dangers of overprivileged users. It shows how to lay the proper groundwork for implementing a least privilege strategy in terms of identifying critical data assets, mapping them to privileged accounts, and incorporating a privileged account lifecycle of protection.  It then provides five key action steps to help assure success in implementing least privilege, including the combination of least privilege with application control—essential to any least privilege plan.

Before you make any decisions to deploy an Endpoint Protection Platform (EEP), or any kind of complex Endpoint Discovery and Remediation (EDR) solution, you need to consider how a implementing a least privilege strategy with application control could work in your organization.  It could save you enormous amounts of time and resources by limiting privileges to stop exploits in their tracks.

Organizations around the world are challenged by an ever-growing cyber threat landscape and are experiencing serious cyber fatigue. Their employees are dealing with constant information overload about cyber attacks, ransomware, identity theft and phishing scams.

Employees are exposed to risky behavior

For years, employees across all departments in most organizations have habitually practiced risky behavior, usually unintentionally. They do this by clicking on attachments or links within emails not knowing what might happen next; by logging into internet services using the same password they have chosen for their Facebook account, corporate email and bank account; or by simply plugging a USB stick they found in a café into their laptop.

Your organization is under pressure to meet compliance … but nobody knows if the next email is the one that contains malware

Cyber Fatigue is occurring at all levels of the organization, from the CISO looking for metrics on the company’s exposure to cyber-attacks to the IT Security team trying to force employees to be more secure. The organization is under pressure to meet compliance, and employees need to perform their daily tasks, but nobody knows if the next email is the one that contains malware.

The balance between security and ease of use is critical

IT Security tries to balance the needs of the business while at the same time securing and protecting the organization’s most valuable assets.  To secure the organization, IT Security usually attempts to reduce privileges to employees’ access. However this can create conflict between IT Security and the rest of the employees.

Despite efforts to raise cybersecurity awareness and train users on secure behavior, 25% of your employees will open phishing emails, and more than one in ten will click on an attachment that contains malware. (See more alarming stats on this infographic.)These types of successful social engineering attacks are just one reason why employee workstations and personal devices are the most vulnerable part of your IT systems.

All it takes is one compromised user with local administrative privileges to gain full control or even take down your entire network

Privileged accounts exist everywhere in your IT environment. In many cases, users may not even realize the type of access they possess. They only know that when access is denied, they can’t get their work done. Hackers and cyber-criminals target these privileged accounts because once compromised, they provide the ability to move across your systems and networks undetected.

A world of too many over-privileged users increases the business’s cyber risks

Organizations today typically face major challenges when implementing a least privilege policybecause built-in limits on access can impact employee productivity. One thing is clear: when an employee has too many privileges you typically do not hear from them, but when privileges are limited or restricted and the employee is unable to access an account, launch an application or connect to a printer, the IT help desk will surely be the first to know.

Unhappy employees are quick to call the help desk when they are unable to perform their jobs. This usually results in the IT help desk making the user over-privileged, and while they can now perform their job it is at the increased risk of turning a simple incident into a major catastrophe. Should the over-privileged employee fall victim to a cyber-attack, the attack could easily escalate to the entire organization.

Introducing the Principle of Least Privilege

Least Privilege is the concept of giving only the minimum permissions to an end-user, application, service, task or system to perform the jobs they have been assigned, or enable elevate on demand for the privileges needed at that time without impacting productivity or involving the IT help desk. This helps reduce costs, increase efficiency and reduce risks.  By definition, least privilege is intended to prevent “over-privileged access” by users, applications, or services to help reduce the risk of exploitation without impacting productivity.

Least Privilege access control is a technique that is used to help enforce Zero Trust and includes a Risk-Based security strategy.  Zero Trust is a place where most organizations should begin, and this means that all access request by any user or system to the network, services, applications, data or systems is verified, and trust is built but continuously challenged if the trust is changed. This requires organizations to classify users and systems into trust risks, for example, different security controls between employees, contractors, suppliers, temporary or department sensitivity.

Cybersecurity classifications of trust and accepted risk can be dynamic. That is, you create different policies or rules across the enterprise for identities, services, applications, data, and systems.

The more access you have or request the more security controls you must satisfy before you get access.  You can have the choice of trust as always, verify, or always audit, depending on how much risk you must reduce.

When starting with Least Privilege you will first want to do the following:

DISCOVER ALL Admin and Local Admin Privileges

First, you should automatically discover all admin and local admin privileges across the environment, and this includes privileges inherited via group memberships.  It is important to know what employees, devices, software, services, applications and hardware have privileged accounts provisioned.  This will help identity where your organization is compliant with industry compliance requirements, and possible gaps that need to be secured further.

INVENTORY ALL your Devices and Software

It is critical that you know what software is deployed and how software gets deployed, so knowing where it was installed from in the first place is a good way to get to know the organization’s risks.  Was software installed from SharePoint, a USB device, downloaded from the internet, via an email or deployed using a software delivery solution?  This will help determine what applications you have, whether you are properly licensed, trusted vendors your organization depends on, suspicious applications, and the most common method chosen by users to install the software.  Depending on your organization’s IT Policy, you might want to determine at this stage your preferred method of deployment, and what should be restricted.

MONITOR PRIVILEGES and Learn Usage

Before enforcing restrictions or least privilege you will want to learn about the common usage: which employees are actively using their privileges and which users are potentially over-privileged.  Now you can determine which users’ administrative privileges need to be replaced with policies to ensure that they can continue doing their job without any disruption.

REPLACE PRIVILEGES with Automation Policies

Once you have audited the environment you can start to remove or reduce privileges from users who no longer require them. For those who actively require them you can replace privileges with policies that allow the task to be elevated on demand without the user becoming over-privileged.