Privilege or access creep poses a threat to security in all networks but can be a particular problem in larger companies where many employees share enterprise resources and inappropriate access levels often go unnoticed for a long period of time which can potentially lead to devastating breaches.
Understanding Access Creep
Privilege creep occurs when employees accumulate more access rights than are required to perform the tasks associated with their positions. Also called access creep, the process occurs gradually over time and is often the result of:
• Failure to revoke temporary access granted for special projects
• Updated job duties or requirements
• Promotions or changes in position within the company
In all these cases, employees may retain access to data, applications and resources unrelated to their duties, thereby putting the system at risk in a number of ways. The most notable of these risks include:
• Increased potential for insider threats resulting from the use of excessive access for personal gain or retaliation by disgruntled or dissatisfied employees
• Hackers’ ability to infiltrate higher levels of the network using a single set of stolen credentials
Accumulation of unnecessary privileges also poses a threat to compliance, especially in enterprise environments handling highly sensitive data, such as Social Security Numbers or health records. Failing to maintain compliance with privacy laws and regulations or suffering a breach in which large amounts of data are lost or compromised can have severe financial and reputational consequences.
Excessive Access in Privileged Accounts
Some users within enterprise systems, such as administrators and managers, require access to sensitive data or resources to do their jobs efficiently. Services and applications may also need a higher level of access to ensure workflows proceed without interruption and communication across the network is maintained. Alarmingly, the 2016 Verizon Data Breach Investigations Report revealed 53 percent of breaches result from the misuse of credentials associated with privileged access. It’s not uncommon to find credentials for sale on the Dark Web, and a hacker needs to purchase only one set to undermine the integrity of an entire enterprise system.
In many cases, users make it easy for hackers to obtain login information and access networks without buying credentials. About 80 percent of access breaches in enterprises result from weak or stolen privileged account credentials, and once hackers hijack these accounts, it can be difficult to determine the true extent of a breach. Privilege creep exacerbates the problem by extending hackers’ access deeper into the network. It can take IT professionals a considerable amount of time to sort through access information, pinpoint the cause of the breach and implement countermeasures to restore network security.
Smart Strategies to Maintain Appropriate Access Levels
Proper identity and access management strategies can prevent privilege creep and reduce the risk of associated data breaches. Enterprises must focus on following best practices to establish and maintain strong identity governance policies.
The principle of least privilege provides a baseline for managing all user accounts. By granting each user the lowest level of access necessary to fulfill his or her role within the company, enterprises can ensure smooth workflows while preventing unauthorized access across the network. Enterprises should also consider implementing role-based access in lieu of user-based methods to assign access levels based on the tasks a user must complete rather than associating privileged access with individual accounts.
Auditing and Recertification
Routine access audits clarify access needs for enterprise users and pinpoint areas of weakness, including abandoned or orphaned accounts. Removing these accounts eliminates points of weakness hackers could otherwise exploit. Periodic recertification subjects active user accounts to scrutiny to determine if current access levels are appropriate or need to be adjusted. These processes are an essential part of access management and could benefit the 52 percent of enterprises unable to account for all privileged credentials within their networks. Clear policies for managing temporary access and processing changes in employee roles within the enterprise reduce the risk of access privileges extending beyond what’s appropriate. Identity Management Institute members include experts in access audit and certification.
Many enterprises continue to rely on passwords and other outdated authentication methods, and a surprising 54 percent use paper or Excel spreadsheets to store details about access credentials. In situations where the use of passwords remains necessary, credentials must be managed in a secure centralized location to prevent loss or compromise. Switching to multi-factor authentication relying on stronger methods, such as the use of hard tokens, one-time PINs and geofencing, makes it more difficult for hackers to penetrate deep into networks.
Preventing privilege creep at the enterprise level starts with clarity regarding access needs throughout the company and the establishment of strategic access management strategies. With the use of intelligent identity management tools and strong authentication methods, it’s possible to manage employee access to reduce the risk of internal and external breaches resulting from the misuse or compromise of privileged credentials.
Subscribe to the Identity Management Journal to receive periodic announcements and articles.