Cyber Tip: Administrative Accounts and Password Security

In today’s IT System Administration Environment, where a user or IT professional is given an administrative account to manage services, application installs, and server management, a single source of access across all these functions can lead to disastrous results in the event of a breach. If there is only one admin account that manages your Server Environment and that account is spread across a wide base of functions, access to that account can give an attacker access to everything. If the attacker cannot get access to everything at once, their attack will be isolated to one environment. 

An example:

Your company has a cloud file share platform, like MS SharePoint, MS OneDrive, Box, Dropbox, etc. and a cloud mail exchange platform, like MS Exchange or Google suite. You have one employee logging in with one account to administer your email and your file sharing. 

The employee does not protect their password with multi-factor authentication or biometrics. The minute their password gets stolen or infiltrated through phishing, your email and your file sharing are now administered by someone else. The longer they have access, the faster they change the contact and profile details, and keep you from being able to get into the account. 

In Microsoft, the administrator with control of all applications and platforms is called the Global Admin. This type of admin can control all platforms within an enterprise. Great care should be given to consider, who should be a Global Admin and why? Most modern models may have two Global Admins and sub admins for each platform. This builds an environment with multiple sources of access but that are siloed so there is no one source for all access.

When was the last time your company audited administrative privileges in your enterprise? Who has access to what and with what control level? Finding the answer to these questions, spreading the administrative duties on a broader scale, and using good password security will protect your infrastructure for long enough that the attacker may move on to a softer target. 

Put as many roadblocks in your environment as you can, to prevent infiltration from a cyber-attack.