Why admin accounts are an unnecessary exposure to risk

One hundred percent security cannot be guaranteed in the cyber world. No matter how many safeguards you put in place, there will always be some risk. This is based on the simple premise that if you are 100% secure, there is no functionality. As soon as you add functionality, it will decrease the overall security. Therefore the simple analysis to always perform when adding functionality is whether it is worth the overall security exposures.

The problem is that most companies only look at the benefit of a new functionality but never ask the follow-up questions:

• What is the security risk associated with this functionality?
• Are there other more secure alternatives?

This gap in performing proper analysis is never more evident than with administrator access. A user or business unit complains that they need administrator access and, without verifying or validating the request, they are given the access without the proper analysis.

If you want to be secure, users cannot be logged in as an administrator. If you are like many companies that I work with, the initial response is that they need or require that access – those are very strong words. A premise that should drive all security decisions is to let data drive decisions, not emotions – do the math.

What benefit do you gain by providing them with administrator access versus the potential increase in exposure or damage to the company by allowing the access? If you do proper analysis, you will find what Avecto discovered: that taking away administrator access can mitigate 80% of all Critical vulnerabilities and 95% of Critical vulnerabilities in browsers.

Author bio:

Dr. Eric Cole is a renowned security expert with over two decades of in-the-trenches experience in IT and network security. He is the author of several books and textbooks, including Advanced Persistent Threat, Hackers Beware, Hiding in Plain Sight, Network Security Bible 2nd Edition, and Insider Threat, and has presented at many major conferences. He also served as a member of the Commission on Cyber Security for the 44th President, Barack Obama, and sits on several executive advisory boards.

"Each chapter in Dr. Cole’s latest book offers real life examples and steps anyone can take to protect their information – like proactively getting a replacement credit card when there’s been a breach, or using phrases to create strong passwords. The kind of personal cyber security that Dr. Cole talks about in his book isn’t rocket science; it’s good, common sense and easy to do."

'Online Danger: How to Protect Yourself and Your Loved ones from the Evil Side of the Internet' can be downloaded here.

@DrEricCole, secure-anchor.com