The Concept of Least Privilege
The fundamentals are often the most underappreciated part of the job in cyber security. In order to achieve a well-managed, secure environment, there must be focus on limiting exposure to risk by reducing the amount of rights and access provided. This is often described as limiting your threat surface.
Least privilege essentially means to provide access to only what is required for a user to perform their job functions and nothing more. An example is that if a user role is sales, they likely do not require access to any of the data associated with the finance team. Broadly distributed access to shared resources is the easiest way for a ransomware attack to impact a much larger part of the environment.
A corollary to this, but perhaps the greatest source of risk, is administrative rights to a computer. Admin rights, or more specifically the ability to install software or edit operating system registry settings, should never be directly associated with a user account. Instead, this should require an elevation which challenges for a password and ideally a second factor authentication.
Simple tips to practice least privilege:
- Document the user role types you require and try to keep the list as small as possible
- Define rights required for each role type to only the required needs
- Establish authentication groups to match the role types and use-only groups in assigning privilege
- Ensure that no user has direct admin rights on a PC
- Create a checklist for yourself to regularly review and make modifications as required to the groups
Cloud Conversation: An Engineering Perspective
Migrating to or already in the cloud? Read the recap or watch the recording of our recent engineer-led conversation about securing the cloud and improving environments.
DIY Security: Know When to Call in Experts
Deciding between keeping IT security tasks in-house or relying on a partner with specialized expertise, can be compared to managing home improvement projects. There are many things you can try to repair using the Do-It-Yourself approach. If everything goes just right, you might save yourself some money, and hopefully, you’ve got time left over to relax. But what if everything goes wrong?
Why Network Security?
Take a moment and think about your company’s network as your home. In our houses, we go to great length to secure ourselves—doorknob locks, deadbolts, smart locks. Now look at your corporate network, how do you feel about the front door of your network? Does it give you the same sense of security that the front door of your home does? This is why we need network security.
Why Scientists Should Care About Security
Once ransomware is resident on a system, it can be a simple money collection exercise or a means to an end to capture intellectual property. Lost intellectual property may allow an organization in another country to leap forward and deliver your discoveries.