Privileged access, and who reviews it

Administrators can bypass most of what you built

Controls are configured by somebody, and that somebody can generally reconfigure them, clear the record of having done so, and reach anything the system holds.

This is not a reason for suspicion of administrators. It is the reason the standard treats privileged access separately, and the reason a programme that ignores it has a gap running underneath every other control.

Ordinary practice, in order of effort

Separate accounts. An administrator's daily account is not their privileged one. Cheap, immediate, and it means a compromised email session does not carry administrative rights.

Least privilege. Rights scoped to what the role requires. Most environments grant broad rights because it was simpler at setup and nobody revisited it.

No shared administrative credentials. Named accounts, so that an action attributes to a person. Where a shared account must exist, it is controlled as below.

Logging elsewhere. Privileged actions recorded to a system the administrator cannot alter. This is the one that makes the others verifiable.

The account for when everything else fails

Most environments need one. It should be documented, its credentials held securely and split where practical, its use alerted on, and every use reviewed afterwards.

An emergency account with no alerting is an unmonitored master key, and its existence is usually known to more people than the register suggests.

One person who is everything

Separation of duties assumes several people. A manufacturer with one information technology person cannot separate anything, and pretending otherwise produces a document that describes a fiction.

What works instead is compensating: log privileged activity to somewhere that person does not administer, have a second person, not necessarily technical, review the log periodically against a simple question, and require the compliance owner or a director to approve changes to security-relevant configuration.

None of that is as good as separation and all of it is defensible, documented, to an assessor who understands the size of the organisation.

The widest access is frequently external

Managed service providers, equipment vendors and integrators often hold administrative rights, sometimes broader than anybody internal. The entry on remote access covers the route; the privilege itself needs the same treatment as an employee's: named, scoped, logged, reviewed.

Quarterly, and it always finds something

Who holds privileged access, on what, and why. Compared against the list from last quarter.

The recurring findings are an account belonging to somebody who changed role, a vendor account from a finished project, and a rights grant made for a migration two years ago.

What to be able to show

The list of privileged accounts with their justification. The separation between daily and privileged accounts. The log destination and who can alter it. The break-glass procedure and its use records. And the quarterly reviews, dated.

Where separation is impossible, say so

A written statement that the organisation is too small to separate these duties, naming the compensating controls and who reviews them, is a legitimate answer.

An unwritten one looks like an oversight, and the difference between the two is a paragraph.

Elsewhere in insider risk

• What the three levels are, and which appliesThe level is set by your contract, not by your size. Most suppliers handling controlled unclassified information are at the second.
• Reading the clause that binds youReading the clause that binds you. What the requirement says, what it means in practice, and what an assessor will ask.
• Which systems are in scopeWhich systems are in scope. What the requirement says, what it means in practice, and what an assessor will ask.
• Self-assessment, and why the scores driftedSelf-assessment, and why the scores drifted. What the requirement says, what it means in practice, and what an assessor will ask.
• Who assesses you, and how each kind worksWho assesses you, and how each kind works. What the requirement says, what it means in practice, and what an assessor will ask.
• What the standard does not requireWhat the standard does not require. What the requirement says, what it means in practice, and what an assessor will ask.
• Machines older than the requirementsA control written for a server, applied to a lathe with a shared login, a decade-old operating system and a USB port.
• Drawings, job packets and paperDrawings, job packets and paper. What the requirement says, what it means in practice, and what an assessor will ask.
• Removable media, and why bans failRemovable media, and why bans fail. What the requirement says, what it means in practice, and what an assessor will ask.
• Vendor remote accessVendor remote access. What the requirement says, what it means in practice, and what an assessor will ask.
• Technical data packages and what they containTechnical data packages and what they contain. What the requirement says, what it means in practice, and what an assessor will ask.
• Segmentation, and what it does not solveSegmentation, and what it does not solve. What the requirement says, what it means in practice, and what an assessor will ask.
• What insider risk actually coversWhat insider risk actually covers. What the requirement says, what it means in practice, and what an assessor will ask.
• What detection can and cannot establishWhat detection can and cannot establish. What the requirement says, what it means in practice, and what an assessor will ask.
• Monitoring, and where the law constrains itMonitoring, and where the law constrains it. What the requirement says, what it means in practice, and what an assessor will ask.
• The fortnight around a departureThe fortnight around a departure. What the requirement says, what it means in practice, and what an assessor will ask.
• False positives, and what they costFalse positives, and what they cost. What the requirement says, what it means in practice, and what an assessor will ask.
• The documents an assessor reads firstThe documents an assessor reads first. What the requirement says, what it means in practice, and what an assessor will ask.
• What counts as evidenceWhat counts as evidence. What the requirement says, what it means in practice, and what an assessor will ask.
• The findings that recurThe findings that recur. What the requirement says, what it means in practice, and what an assessor will ask.
• Plans of action, and their limitsPlans of action, and their limits. What the requirement says, what it means in practice, and what an assessor will ask.
• What the assessment week is likeWhat the assessment week is like. What the requirement says, what it means in practice, and what an assessor will ask.
• The certificate, and what it coversThe certificate, and what it covers. What the requirement says, what it means in practice, and what an assessor will ask.