How to remove admin privileges without teeing people off

Administrative privileges have long been a prickly subject between IT teams wanting to secure corporate networks and employees wanting to go about their jobs, hassle free.

The tricky nature of striking a balance between security and productivity often leads to a best-efforts approach which too often widens the security gap. But as the threat landscape continues to evolve, a best-efforts approach won't cut it. The good news is there is now a way to get it right – and it isn't hard to do.

The team at Devicie has many years of experience in helping organisations to protect sensitive data, comply with complex regulation and defend against cyber attacks. And the issue of admin privileges is one that comes up in almost every single project.

A breach waiting to happen

Organisations hoping to dodge a cyber bullet using traditional practices around local admin have some pretty big odds against them.

The numbers speak for themselves: As far back as 2018, Forrester estimated at least 80% of security breaches involved privileged credentials. Last year Gartner estimated that by 2023, 75% of all cloud security failures would result from inadequate management of identities, access and privileges.

From a security perspective, it's easy to see why it's so important to restrict admin privileges. It's right up there on the ASD Essential 8 and the NIST Risk Management Framework. Giving any employee more privilege than they need to do their job is a mistake. It makes it easier for those permissions to be intentionally or accidentally misused, abused or hijacked. And, in the wrong hands, it's all downhill from there. They can disable endpoint security and antivirus software, install malicious software, encrypt data with cryptolockers or even use the system to access and steal other company resources. These are all levers that can be leveraged to perform a ransomware attack.

Of course, restricting or removing admin privileges isn't black and white.

When security gets personal

When the topic of removing admin privileges comes up in conversation, it's usually followed by a notable shift in the air. It's human nature to take issue when something is taken away. Some individuals take the removal to imply they don't have the smarts to use those privileges responsibly. Of course, this is not the case. The reality is IT can't know with 100% certainty that someone with said privileges will not be successfully breached.

Beyond the personal, when someone gets fewer permissions than they think they need (or actually need), they might struggle to do their job productively. And there may be times when some individuals temporarily require privileges for a specific task that falls outside of the standard policy.

Time meant for working might therefore be spent seeking support from an already overstretched IT team to gain permissions in what becomes a completely counterproductive game of hot potato. Eventually, someone drops the ball. Too often, IT administrators eventually decide that they can make the problem go away by granting privileges to a 'trusted' individual. Then another request comes along. Before long, there is privilege creep and a major visibility gap: no one knows who has privileged access or even what applications are running on certain devices. It's a big security problem.

Research highlights the disconnect between security and productivity well. In a 2021 study from HP, 67% of IT leaders said they get 'weekly' complaints about restrictive policies while 48% of all workers felt these measures were a waste of time.

It might sound all doom and gloom, but with the right structure and policies, coupled with automated application management, there is a light at the end of the tunnel.

How to make it easier

There is a future state that organisations can move to quickly, where abiding by the principle of least privilege – without the headache – is business as usual.

In this environment, employees can access the applications they need to do their job productively, while IT has the automated controls and visibility to ensure uncompromising security, efficiency and ongoing compliance.

It may sound too good to be true, but it's already happening and becoming increasingly necessary given the trajectory of the threat landscape.

Of course, organisations first need to weigh their requirements against the level of risk they can accept when considering admin privileges. This starts with getting the right people in a room to have a constructive conversation about the business needs and risks, and the policies, structure and tech needed to achieve an outcome that works for security without dismantling productivity.

There will be a multitude of reasons for granting exceptions across different organisations. Take the following examples:

• "Our developers need to experiment with different tool sets"
• "Our IT team needs to set up a proof of concept"
• "Our consultant needs to download something while on a client site on a weekend"
• "Our PhD students need to try different modelling tools" 

While these reasons are unique, the framework to manage exceptions should be largely the same in every organisation.

Achieving this in the most efficient way requires the right mix of automation and a growth mindset. It requires the understanding that it is no longer acceptable to turn a blind eye to admin privileges, and that an agreement must be made on how best to manage it.

By leveraging agentless, cloud-native technology, organisations have an opportunity to reinvent the way they manage administrative privileges altogether.

With the Devicie platform, for example, organisations are given access to a corporate company portal, which houses applications for employees to access. This enables automated management of all software, including operating systems and applications, so that only authorised software is installed and can execute, and that unauthorised and unmanaged software is prevented from installation or execution. This is all achieved without granting users extra privileges.

Not only does this eliminate the need for end users to have admin privileges, but it enables IT to have complete visibility and control over the applications residing on all employee devices. Gone is the need to worry about the security risks of rogue applications or the need to keep the peace with employees. They can do what they need to do without carrying the burden and risk of administrative access.

It's the perfect win-win situation, for security and productivity.

Automation almost always makes sense, but if there's one area where automation truly shines, it's application management. And it's the first point that Devicie addresses in the Essential Checklist to Automating Least Privilege. Download your copy to see how you can leverage automation to remove admin privileges in a way that supports a productive and efficient workforce.