Chapter 15 — Privileged access

Chapter 15 — Privileged access

Lesson map

Lesson 15 published. Map, example, EX043.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 Finding privileged accounts"]
  N2["15.2 Separating accounts"]
  N3["15.3 Monitoring admin use"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX043"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 Finding privileged accounts"]
  N2["15.2 Separating accounts"]
  N3["15.3 Monitoring admin use"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX043"]

[Learning outcomes]
    |
    v
[15.1 Finding privileged accounts]
    |
    v
[15.2 Separating accounts]
    |
    v
[15.3 Monitoring admin use]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX043]

Learning outcomes

You will (1) identify privileged accounts; (2) separate admin from daily accounts; (3) protect and monitor admin use.

15.1 Finding privileged accounts

Privileged accounts can change other people's access, read everything or alter system settings. Kai lists them: two directory administrators, the practice management administrator, payroll administrator and the backup service account. He finds that the IT person uses one account for both email and administration, meaning a malicious email could act with admin rights. He also finds a former contractor still listed as a directory administrator, disabled but not removed from the role. Kai records each privileged account with its owner and purpose. He confirms the list with the practice manager.

15.2 Separating accounts

Kai proposes separate admin accounts, such as admin-kt for his own use, used only for administration and never for email or browsing. Daily work uses a normal account. Admin accounts use passkeys and cannot sign in from unmanaged devices. The former contractor's role assignment is removed. Separation means that ordinary phishing, which targets daily accounts, cannot reach administrator rights, and admin activity becomes easy to recognise in logs. Kai explains the reason to the IT person, who agrees once she sees that daily email never needs admin rights. The change takes an afternoon and costs nothing.

15.3 Monitoring admin use

Admin sign-ins and changes are logged, and Kai sets an alert for any admin sign-in outside working hours or from a new location. Each month he reviews admin activity with Ruth, checking that changes match tickets or requests. A small business cannot run a full security operations centre, but a regular, short review of a handful of admin accounts is achievable and catches mistakes and misuse early. Ruth suggests recording the review outcome each month, even when nothing is found. The review usually takes about twenty minutes, which makes it sustainable for a small team.

Worked example

Five privileged accounts are listed; admin and daily accounts are separated, and one stale admin role assignment is removed.

Synthetic case. Accounts and findings are synthetic.

Errors and limits

Using one account for email and administration exposes admin rights to ordinary phishing.

Exercises

• EX043 — Combined account risk. Why is a combined email/admin account risky? Rubric: 3 = a malicious email could act with admin rights;; 2 = phishing;; 1 = cost;; 0 = none.
• EX044 — Stale admin. What stale admin issue was found? Rubric: 3 = former contractor still in admin role;; 2 = contractor;; 1 = vague;; 0 = none.
• EX045 — Admin alert. When does an admin alert fire? Rubric: 3 = outside hours or new location;; 2 = out of hours;; 1 = always;; 0 = none.

Synthesis

Separate, strongly protected and monitored admin accounts keep privileged access contained.

Continue studying — chapter 15 of 30

← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →