Excess privilege makes companies and data insecure

One of the most important principles of good computer security is the principle of least privilege: A user should have no more access to data and systems than is necessary for their task. Too often, security problems result from users having excessive privileges and excessive access to data. For a good example of just how bad things can go for the organization from giving users more access than they need, look no further than the story of Edward Snowden, NSA contractor.

If even the NSA, where "Security" is their middle name, doesn't take it seriously enough, how much effort is the average private company putting into privilege management? Not much. A new survey from BeyondTrust, which makes software to assist companies in limiting user privilege, demonstrates that bad privilege habits run rampant.  I spoke with BeyondTrust CTO Marc Maiffret, an old pro in the security field.

Some of the highlights of the survey:

• 44 percent of employees have access rights that are not necessary to their current role

   

• 80 percent of respondents believe that it’s at least somewhat likely that employees access sensitive or confidential data out of curiosity

    

• Over three-quarters of respondents say the risk to their organization caused by the insecurity of privileged users will increase over the next few years

    

• Customer information is considered most likely at risk if there’s a lack of proper access controls over privileged users

Windows and other operating systems have improved over the years at making good privilege management easier to implement, but in a large organization it can still be difficult. For instance, Maiffret says businesses are much better at setting users to run as a Standard User in Windows 7 than they were with Windows XP. This is because you couldn't get a lot done running as Standard User on Windows XP.

But there are still many applications, especially older custom applications, which require permissions greater than the default Standard User permissions.  In those cases, you can hand-tweak permissions or you can use a tool like BeyondTrust's PowerBroker to manage it on with a broader approach. It integrates with Active Directory, puts all administration in a single console and delivers recurring reports so you can see if permissions have gotten out of date.

Operating systems are continuing to get better  at this. Modern UI apps in Windows 8 run, by default, in a sandbox and with lower privilege. You have to deliberately elevate permissions.