- [Instructor] Security administrators must pay
careful attention to the permissions and use
of end user accounts to protect against security incidents.
Two major account administration issues
face security professionals.
The first is inaccurate permissions assigned to accounts
that either prevent a user from doing his or her work
or violate the principle of least privilege.
These permissions are often the result of privilege creep,
a condition that occurs when users switch jobs
and gain new permissions but never have
their old permissions revoked.
The second issue is the unauthorized use of permissions
either by someone other than the legitimate user
accessing the account or by the user
performing some illegitimate action.
To protect against the first issue,
administrators should perform
regular user access reviews in cooperation
with managers from around the organization.
During each review, administrators should pull a listing
of all of the permissions assigned to each account
and then review that listing with managers
to ensure that it is appropriate for each user's role,
making any necessary adjustments.
Administrators should pay careful attention
to users who switch jobs since the last account review.
Protecting against the unauthorized use of permissions
is a little trickier, because it can be hard to detect.
This requires the use of continuous account
monitoring systems that watch for suspicious activity
and alert administrators to strange actions.
For example, a continuous account monitoring system
may flag logons from strange locations
such as a user connecting from both the home office
and a remote location in Eastern Europe at the same time,
logons at unusual times such as a mail clerk
logging in to the system in the middle of the night,
deviations from normal behavior
such as users accessing files
that they do not normally access,
and high volumes of activity that may represent
bulk downloading of sensitive information.
The specific circumstances that merit attention
will vary from organization to organization,
but performing behavior-based
continuous account monitoring
is an important security control.