One of my most frustrating, yet still understandable, conversations I have with the business owners I work with is regarding the restrictions they should place on their team members—namely, that they should put these restrictions in place at all.
Let’s talk about why it is a bad, bad idea to give every single person on your team full admin permissions on your network.
What Happens if Admin Privileges are More Lax than They Should Be?
First, it will help to understand how permissions and privileges work. Whenever a user logs into their network profile, the permissions granted to that profile dictate what the user can access or do. This is one of a business network’s most critical defensive measures.
Let’s assume that Stephen accidentally downloads an infected file from a spam email. If Stephen was only given network access that matches his role, the damage (while still unfortunate) is limited to what Stephen could access.
On the other hand, let’s assume Stephen’s boss had all employees given full admin privileges. If Stephen clicks into that same spam email, there are effectively no limits to the damage that can be done:
- Undermined system defenses - Generally speaking, an attacker who gets access to your network with admin privileges will immediately disable your endpoint security, from Windows Defender and your firewalls to any monitoring tools you have set up.
- Foundational threats - Admin privileges also let an attacker interface directly with your underlying network infrastructure, including your registry and sensitive system directories. From there, an attacker has significant power: they can alter boot sequences, install secret rootkits, and add user accounts that persist through reboots.
- Stolen credentials - Naturally, if an attacker can do all this with admin privileges, it's little surprise they can also steal stored access credentials from the computer’s memory.
This is before we even mention the biggest issue: the network proliferation that admin privileges enable.
Malware moves around as much as it is able. Once it gains local admin control on one endpoint, an attacker will check the stolen credentials to see whether they work on other machines, too. If they do, the attacker uses them to move from computer to computer until they reach your servers or other major infrastructure hardware.
Suddenly, you’ve gone from dealing with one infected machine to dealing with an entirely infected network.
Worse, The Access That Allows These Attacks is Almost Always Unnecessary
Too often, I hear concerns that taking away this level of permissions will ultimately hurt team productivity, or even their morale, as the team realizes they don’t have the same access they once did. You may be thinking about this outcome even now, as you read this.
Before you absorb too many of these thoughts, let me ask you this: if you hired someone to house-sit for you, what keys would you give them? You’d probably give them the key to the house and maybe a security code for any security system you have, but would you give them anything else, like the key to the garage, your car, or your home office? Of course not… that’s far more than they’d need to simply check in on the house, take in the mail, and maybe feed a pet.
So, why would you do anything differently when handing over access to your business?
This is the fundamental idea behind the Principle of Least Privilege. True to its name, the Principle of Least Privilege is simply a commitment to give every member of your team the minimal amount of access permissions necessary to complete their routine tasks. It is effectively the average between security and productivity.
Protecting Your Business From the Endpoints In
Let’s assume for a moment that you’re interested in tightening your team’s access to meet the Principle of Least Privilege. A few key steps will help you do so effectively:
- Check how your permissions currently stand. Scrutinize and evaluate everyone’s access to ensure each user’s permissions align with their role. If you have any vendor accounts or former employee accounts with access privileges, start there.
- Determine who needs additional permissions. Sometimes your team members will need heightened access to complete their tasks. Granting temporary permissions or creating more secure admin accounts for these users ensures access is granted only on a need-to-know basis.
- Take advantage of modern tools. Endpoint Detection and Response tools allow you to identify trusted applications. Once identified, these trusted apps can have their permissions elevated automatically, greatly simplifying the update process.
- Be transparent with your team. Communication is key to implementing these safeguards without insulting or alienating your team members. If you frame it correctly, as a safety measure to protect the business and all of their livelihoods, chances are you’ll receive team buy-in much more quickly.
Keeping Your Business Safe Without Micromanaging Your Team
While it may seem relatively simple, managing user access permissions and admin rights is a highly effective way to get a head start on protecting your business. Many threats are stopped quickly before they can spread across your network.
If you need assistance in evaluating and adjusting your business’ network infrastructure, we’re here. Find out more by calling (954) 575-3992.
Comments