Superuser/Superuser Accounts

If misused, superuser accounts can inflict catastrophic damage to a system/organization. Misuse can either happen in error (e.g., inadvertently deleting an important file or mistyping a powerful command) or with malicious intent.

While most security technologies are developed to protect the perimeter, superusers are already on the inside. Superusers may be able to change firewall configurations, create backdoors, and override security settings—all while erasing traces of their activity.

Inadequate policies and controls around superuser provisioning, segregation, and monitoring further heighten risks. Database administrators, network engineers, and application developers are frequently given full superuser access. Users often share superuser accounts between them, which muddles the audit trail. In the case of Windows PCs, users often log in with administrative account privileges—far broader than what they need.

In one of the most notorious tales of a rogue insider, Edward Snowden, an IT contract worker for the NSA, abused his superuser privileges. He was able to access, copy, and leak over 1 million highly sensitive NSA files. In the wake of this scandal, the NSA targeted 90% of its system administrators for elimination, to better establish a least-privilege security model.

Attackers covet superuser accounts knowing that, once they assume these accounts, they essentially become a highly privileged insider. Additionally, malware that infects a superuser account can leverage the same privilege rights of that account to cause damage and steal data.

Organizations looking to rein in and secure superuser accounts should implement some or all of the following best practices:

1. Discover and Onboard All Superuser Accounts: First, organizations need to find and onboard all superuser accounts so they can enforce proper security and auditing controls. The proliferation of cloud accounts with superuser privileges makes this undertaking more difficult. It's essential to gain visibility of all elevated access rights, entitlements, and privileges across the entire IT estate to ensure no security gaps.

2. Enforce Least Privilege Access: Limit superuser membership to the minimum number of people. This can mean temporarily elevating privileges when needed, but without granting full superuser rights to the account. In Unix and Linux systems, the sudo command allows a normal user to temporarily elevate privileges to root level. But, they can do so without direct access to the root account and password.

3. Segment Systems and Networks: Partition users and processes based on different levels of trust, needs, and privilege sets. This way, you can constrain where and how a superadmin can act.

4. Enforce Separation of Privileges: This entails separating superuser functions from standard account requirements. It also involves separating auditing/logging capabilities within the administrative accounts and separating system functions (read, edit, write, execute, etc.).

5. Enforce Superuser Password Rotation and Security: Passwords should meet rigorous security standards. Passwords for superusers (privileged passwords) should be regularly rotated, including after each use for the most powerful accounts.

6. Monitor and Audit All Superuser Sessions: Record, log, audit, and control all superuser session activity to provide accountability and meet compliance demands.

7. Detect and Respond to Attacks: Implement identity threat detection and response (ITDR) to zero in on and neutralize attacks on superuser accounts. ITDR also enables you to recognize attack paths that would lead to superuser account takeover and implement proactive mitigations.