What Hackers Don’t Want You To Know About User Privileges

BeyondTrust, March 9th, 2011

Believe it or there are people out there that aspire to be hackers.  Not just the run of the mill, crack a password or two, but a bona fide Neo who can play with your secure data like a personal version of the matrix.

These would be data pirates and malcontents have websites that teach them their craft and even annual conferences like DEFCON to compare tips, tricks and vulnerabilities.  They are more organized than the average business executive or auditor realizes and they are inspired by nothing short of total access to any and everything on the information super highway, especially what is hidden within your  servers and on any one of your user’s desktops.

The recurring theme and core principal is basically to find access to admin credentials and you own the keys to the kingdom.  So, when users are granted excessive privileges (admin on desktops, root on servers) then you have an environment just begging for a hacker to attack.

Patient to Doctor: Doctor, doctor, when I do this it hurts

Doctor to Patient: Then don’t do it!

Sage advice that hackers don’t want you to know: if you don’t grant admin rights, you don’t run the risk of someone stealing them, hijacking them or even intentionally misusing them from inside.