Personnel Management Strategies

Privileged accounts are those with permissions beyond thatof normal users, such as managers and administrators.

Broadly speaking, these accounts have elevated privileges and are used by many different classes of users including:

• Systems administrators, with principal responsibilities for operating systems, applications deployment, and performance management.
• Help desk or IT support staff, who often need to view or manipulate endpoints, servers, and applications platforms by using privileged or restricted operations
• Security analysts, who may require rapid access to the entire IT infrastructure, systems, endpoints, and data environment of the organization

These few examples indicate that organizations often need to delegate the capability to manage and protect information assets to various managerial, supervisory, support, or leadership people, with differing levels of authority and responsibility. This delegation, of course, should be contingent upon trustworthiness, since misuse or abuse of these privileges could lead to harm for the organization and its stakeholders.

Typical measures used for moderating the potential for elevated risks from misuse or abuse of privileged accounts include the following:

MORE STRINGENT ACCESS CONTROL BEYOND THOSE APPLIED FOR REGULAR USER ACCOUNTS

The record of privileged actions is vitally As we will see emphasized in this course, even non-privileged users should be required to use multi-factor authentication methods to gain access to organizational systems and networks. Privileged users or more accurately, highly trusted users with access to privileged accounts) should be required to go through additional or more rigorous authentication prior to those privileges. Just-in-time identity should also be considered as a way to restrict the use of these privileges to specific tasks and the times in which the user is executing them.

GREATER AUDIT OF PRIVILEGED ACCOUNTS

Privileged account activity should be monitored and audited at a greater rate and extent than regular usage.

EXTENSIVE AND DETAILED LOGGING THAN REGULAR USER ACCOUNTS

The record of privileged actions is vitally important, as both a deterrent (for privileged account holders that might be tempted to engage in untoward activity) and an administrative control (the logs can be audited and reviewed to detect and respond to malicious activity).

DEEPER TRUST VERIFICATION THAN REGULAR USERS.

Privileged account holders should be subject to more detailed background checks, stricter non-disclosure agreements, and acceptable use policies and be willing to be subject to financial investigation. Periodic or event-triggered updates to these background checks may also be in order, depending on the nature of the organization's activities and the risks it faces.

Having one's access control mechanisms

enforce a zero-trust architecture paradigm, and require every atomic action taken by every subject to be fully validated (authorized) prior to letting it proceed has real costs.

In many respects, the use of privileged accounts demonstrates the granularity of controls problem.

At the other extreme, having a singlefactor authentication done one time at first sign-on or connection request, and using this to authorize all actions against any and all objects, is more of a "total trust" architecture, one that is far, far too risky to even think about recommending.

As a security professional, you recommend where to set that threshold knob during planning and implementation, and during real-time operational use.

An organization can implement the practice of job rotation, where all employees change roles and tasks on a regular basis.

This improves the overall security of the organization in several ways:

• An employee engaged in wrongdoing in a Access control systems can and should specific position may be found out when

play an important part in making these the replacement takes over that position strategies more effective. First, the job after rotation. rotation strategy should clearly identify how an individual gains and loses assigned

• The organization will have a staff that

tasks, and the authorities involved with has no single point of failure; many of its those tasks, as they transition from one staff will have had operational experience role to the next.

performing many if not all business process functions (to a greater or lesser

A combination of human resources extent). This can be crucial for business management (HRM) and IAM provisioning continuity and disaster recovery actions.

management functions should work collaboratively to reflect these changes as

• Morale and team cohesiveness can often

required in systems and resource privileges.

be improved as skills and knowledge are

Access accounting and account use audits shared; this fosters a climate in which can also be used to verify the hand-off individuals actively work to protect each of one set of tasks for another has been other and the organization. completed effectively (from the perspective of access attempts, that is).

The mandatory vacation concept aims to reduce chances of fraud and embezzlement and help uncover wrongdoings.

The concept comes from the financial sector in which risk of fraud and embezzlement is increased. The idea is that every employee must take a vacation of several consecutive days while another employee covers their responsibilities, thus increasing chances of detecting any wrongdoing by the person who is away. Some employers take this concept to the extreme and use a forced vacation program requiring the employee to take vacation on specified times.

Unfortunately, one of the most frequently overlooked security aspects in a mandatory vacation policy is the need to temporarily suspend some or all access privileges. Depending on the nature of the work involved, and the compliance regimes the organization is accountable for, it may be more than prudent to set heightened alarm thresholds on the use of identities associated with a person enjoying their mandatory vacation, and on the objects or resources they would normally use during the course of their business day.

Dual custody, also known as dual control, provides a more secure access control architecture in which two or more individuals are required to simultaneously perform separate actions as part of a task or workflow in order to complete a critical action.

Many military systems, for example, cannot arm and fire a weapon without separate actions being taken (such as turning a key or entering a command) by two physically isolated people within a second or two of each other. Overrides of safety-critical process control actions are often implemented with such dual control capabilities.

Another use of dual control is to attain a greater degree of protection for highly sensitive information, whether in digital or physical form, or for highly valuable or unique physical assets. These often involve placing these sensitive items in a specially constructed room or facility and requiring at least two people to maintain vigilant watch over them or be jointly involved in their use. These areas are often called "no lone zones" as a result. Research and development laboratories often use no lone zones to protect the investments in the work being done.

In more mundane use, many banks and financial services companies must protect credit and debit card information by keeping it encrypted. This can end up requiring the use of hardware security management systems (HSMs). Accessing and decrypting the information protected by these HSMs usually requires independent actions be taken by two (or sometimes more) security administrators who are physically present at the HSM.