Cybersecurity: Implementing Least Privilege into Organizations

As previously discussed when we were defining least-privilege cybersecurity for today’s global businesses landscape, organizations have an increasingly serious need to protect their privileged assets. This must be done securing privileges (i.e. passwords) that safeguard such assets. As we know, least privilege is an approach to cybersecurity that reduces the attack surface for hackers by restricting credential exposure and lowering organizations’ risk. One of the primary challenges in adopting any cybersecurity strategy is knowing where to begin, so let’s start with step one.

Identifying Critical Assets

The first step in implementing least privilege into organizations is figuring out what privileges need to be protected. Organizations should use a risk-based approach to cybersecurity which enables them to determine which assets to protect, what security controls they need, and what security challenges they must address to effectively reduce risks.

Organizations should start with a data impact assessment to determine what services, applications, data, and systems are most critical to their specific business, along with compliance and regulations they must meet. They must identify those critical data assets that, if compromised, could cause either major financial harm or disruption of business services.

Mapping Privileged Accounts to Critical Assets

After identifying the most critical information assets, organizations can then define what kind of privileged accounts are associated with these assets:

  • Human (interactive) services, applications, or systems
  • Accessible via hardware, software, on-premises, or in the cloud
  • Used in internal networks or by external services
  • How often they’re used
  • Department or location specific
  • Sensitivity of the service, application, or data the account is protecting
  • Service or system owner for accountability

Much like any IT security measure designed to help protect critical information assets, managing and protecting privileges and the account access granted by those privileges requires both a plan and an ongoing program. Organizations must identify which privileged accounts should be a priority and ensure that employees who are using these privileged accounts understand acceptable use and their responsibilities.

The next step in implementing a least privilege strategy will be to determine privilege usage across an organization’s environment based on how privileged access is defined:

  • Who has privileged access?
  • When it is being used?
  • What actions require privileged access?
  • What security controls should be applied?
  • What are the compliance requirements associated with privileged access?

Adopting the Approach

After identifying critical assets, mapping them to privileged accounts, incorporating Privileged Access Management (PAM) software, and defining privilege usage — an organization is ready for least privilege implementation.

When trying to achieve least privilege cybersecurity in an organization, IT and security teams should follow these steps:

  • Conduct discovery to find out which endpoints and local users have admin rights, what applications are in use, and if they require admin rights to run.
  • Create a whitelist of acceptable trusted applications and processes.
  • Block known bad files with a blacklist or incorporate a reputation service.
  • Manage unknown areas with a greylist and an automated workflow to allow approved apps to run and to block malicious apps.
  • Set contextual policies that align with the risk assessment.
  • Plan for users to change roles or departments.
  • Don’t limit restrict the organization to domain-controlled endpoints only.
  • Don’t forget child processes.
  • Integrate workflow into existing tools.
  • Measure success coverage and existing risks.
  • Enable user interactive elevation requests/workflows.

At Thycotic, we believe that a sustainable least privilege strategy isn’t something that can be set up overnight. It takes planning and collaboration from multiple teams within an organization, as well as the right tools to meet the needs of security, IT, desktop support, and users.

However, beginning with the right plan in place and following the steps necessary to implement least privilege will give an organization the building blocks it needs to establish a strong and modern cybersecurity posture.


Add Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Alliance Data Systems CEO Edward J. Heffernan
10 Things You Didn’t Know about Alliance Data Systems CEO Edward J. Heffernan
How Dirk Nowitski Achieved a Net Worth of $120 Million
10 Things You Didn’t Know About Mark Walter
CEO Wendy Kopp
10 Things You Didn’t Know about Wendy Kopp
Discover it card
The 10 Best Credit Cards for Students in 2019
Omega Healthcare Investors
Why Omega Healthcare Investors is a Solid Dividend Stock
World of Hyatt Credit Card
10 Benefits of Having The World of Hyatt Credit Card
PPL Corporation
Why PPL Corporation is a Solid Long-Term Dividend Stock
Seamless Virtual AI Assistant
How Close Are We to Seamless Talking AI Assistants?
Wearable ECG
How Will Wearable ECGs Affect Our Future?
Computer Vision
What is Computer Vision and How Does it Impact the Future
Pervasive Computing
What is Pervasive Computing and How Does it Factor Into Our Future
Boston Chops Steakhouse
Why Boston Chops is One of Boston’s Finest Steakhouses
10 Reasons to Stay at The Dominick in NYC
Grill 23 Boston
Why Grill 23 is One of Boston’s Finest Steakhouses
Intercontinental Times Square
10 Reasons You Should Stay at the Intercontinental in Times Square
2000 Ferrari Rossa by Pininfarina
A Closer Look at The 2000 Ferrari Rossa by Pininfarina
1956 Ferrari 250 Testa Rossa
A Closer Look at The 1956 Ferrari 250 Testa Rossa
1967 Ferrari 330 P4 Berlinetta
A Closer Look at The 1967 Ferrari 330 P4 Berlinetta
1968 Ferrari Dino 246
A Closer Look at the 1968 Ferrari Dino 246
What to Watch For: A Collector’s Interview
A Closer Look at the Breitling Bentley Flying B No. 3
2019 Breitling
Benefits of Authorized: Avoiding the Grey Market
Breitling Emergency II Titanium
A Closer Look at the Breitling Emergency II Titanium