Why Privileged Accounts Are A Gateway to Cyber Attacks

Last Updated on June 17, 2020 by Ashok Kumar

Thanks to more widespread reporting in mainstream media outlets, it is no longer rare to hear about data breaches causing serious damage to your organization. We are also finding that it is becoming more common to hear about cyber-attacks perpetrated by people from within the organization than from outside hackers.

This is because your users, and in particular your most privileged users, are the biggest threat to your cybersecurity. They already hold the keys to your kingdom and it can therefore be incredibly difficult to spot and prevent them from abusing their privileges. A disgruntled employee or someone who should never have been trusted with access to sensitive data could potentially cripple an organization financially and destroy their reputation with ease.

Knowing this, it’s vital that everyone (not just IT and security teams) understand what it means to be a privileged user and what you can do to help mitigate the threats they pose.

What is a Privileged User Account?

Privileged user accounts are those that give administrative privileges to one or more systems, usually enabling that account to access sensitive data that other users are prohibited from accessing. Such accounts are sometimes shared amongst multiple users, so you may only have a small number of privileged user accounts but a far larger number of privileged users.

Knowing how many privileged user accounts you have, how many users have access to these accounts, what they have access to and what changes these accounts are making is critical to your cyber security.

The Three Threats Privileged User Accounts Pose

Because your privileged user accounts hold higher levels of access than other users, they need to be monitored more closely. The threats that privileged user accounts pose can usually be boiled down into three main categories: the accidental insider, the malicious insider and the outside attacker.

The Accidental Insider Threat

A significant proportion of insider threats are caused unintentionally. All users make mistakes, including users with privileged access. It just so happens that because of the types of data they have access to, the mistakes privileged users make have far more serious consequences. A careless user could make a change to a business-critical piece of data without thinking through the consequences. Or they could grant unnecessary access to a file share where there is no requirement for that access. All such actions needlessly put the data at risk.

The Malicious Insider Threat

As your privileged user accounts already have access to sensitive data, intentional misuse can be tougher to spot than an outsider trying to illegitimately gain access. Unfortunately, being in a position of power can get to your head sometimes and lead to privileged users believing that they are above the law. These people sometimes use the fact that they aren’t monitored as closely as other users to intentionally abuse their privilege. Their attacks may be opportunist in nature or premeditated, but either way they can be devastating.

The Outside Attacker

External attackers will often target your privileged user accounts as they can make use of the elevated privileges to move throughout the network undetected. They may try and trick your privileged users into providing them with the credentials through phishing attacks or may try and gain access through brute force.

Securing Privileged User Accounts

Now you know the threats your privileged user accounts pose to your organization, it’s important that you afford them extra attention when it comes to auditing and monitoring user behavior. Closely monitoring privileged user accounts is vital to enabling users to hold the appropriate permissions for their roles whilst also maintaining data security.

Auditing and monitoring solutions enable you to see which of your users hold privileged access and whenever permissions change so that you can start closely monitoring the users posing the biggest threat to your data security. They will provide you with a granular audit trail of privileged user activity to help you spot suspicious changes taking place that may indicate a threat.

Only by knowing who your privileged users are and what they are doing with your critical data can you get peace of mind when it comes to your cyber-security.