With the severe damage privileged user attacks cause to organizations, avoiding security threats coming from malicious privileged users and the threats they pose to organizations is of vital importance.
Ponemon Institutes released a 2022 report saying that privileged user attacks surged by 44 per cent in 2020, with the cost per attack pegged at $15.38 million.
A privileged user refers to an employee with access to highly sensitive company information, such as source codes, networks, and other technical areas. These higher privileges make sensitive data in the organization vulnerable.
Privileged users may obtain control of more systems or gain admin and root access until they have complete control of the entire environment. Depending on their objectives, it becomes simpler for them to control low-level user accounts and also expand their privileges.
Ways privileged user threats can manifest
1. Credential exploitation
A threat actor may figure out the system administrator’s credentials as their accounts have more privileges to sensitive data and system files. Should a malicious privileged user access these credentials, these may now be subject to exploitation.
2. Privileged vulnerability exploits
Vulnerabilities refer to exploitable code, design, implementation, or configuration flaws for malicious attacks. The vulnerabilities a privileged user can exploit may impact the operating system, network protocols, apps, online apps, and infrastructure.
3. Poorly configured systems
Many configuration problems that a privileged user can exploit are mostly from poorly configured security settings which include using a default password for a system administrator, unauthenticated cloud storage exposed to the internet, and having newly installed software with the default security settings.
4. Malware
Privileged attackers with root access and proficiency with viruses and malware may likewise exploit a number of security loopholes in the organization’s system configurations. Furthermore, using malware like trojans and ransomware may be easier for privileged users as they have root access to the system environment.
How business organizations can stop privileged user attacks
1. Least privilege access
Adopt the principle of least privileged access. This refers to an organizational security practice that supports limiting privileged users’ access to only the data, system, and application pertinent to their role.
2. Security policies should guide privileged users
Ensure that a privileged user security policy exists to guide what a privileged user can and cannot do, including sanctions for violations of security policies.
3. Implement periodic security monitoring
Create a security monitoring team that regularly monitors how all the privileged users use their access in relation to their roles.