On March 2021, Roger Duronio, operating alone, unleashed a logic bomb assault on the UBS Paine Webber network, crippling nearly 2,000 hosts. This act had a significant business effect, which was felt for a long time as the company tried to clean up the mess.
UBS did a lot of things right, and this article isn’t meant to belittle their efforts. Instead, it’s supposed to explain why permissions should be restricted and why the dangers of getting too much access should be carefully considered.
When people have more permissions on IT platforms than they need to do their job, they are said to have “excessive permissions.” Excessive rights in groups and device accounts can also be harmful. The argument is that as the degree of access rises, the company’s risks increase as well.
The need to avoid unnecessary permissions reminds me of the old protection maxim of refusing all rights and allowing just what is needed – a practice that can save a lot of time and money.
Three Scenarios to Avoid
Excessive permissions are typically given in one of three cases.
The first happens when a company is formed with just a small number of IT personnel, or even only one. To keep up with their everyday work and support one another, this small team must take on several tasks. All of the development, network management, and user support could be handled by one person. When more people are recruited, their rights become more similar to that of those who came before them, and as time passes, everyone has a mix of authorities.
Second, some businesses grant all IT admin authority or high-level access to all because it appears to be easier to create an account once and then escapes the management needed to deal with provincial authorities.
The problem is that while this mentality promises increased resilience, it also comes with additional risks for the company. “Are the associated risks acceptable?” one must ask in this case.
Third, although specific organizations have well-thought-out protection protocols when accidents arise, additional approvals are given to an individual to address the situation – but access is not disabled until the fire has been extinguished. Since specific organizations lack the appropriate safeguards to ensure that rights are later revoked, this “permission creep” is very common. An additional control to check accounts regularly to ensure that the related permissions are correct is also required.
In both of these situations, certain persons’ rights are more significant than they should be for risks to be appropriately handled. Excessive requests, as with UBS, can lead to malicious actions.
There are also threats associated with human error on a broader scale. When people are granted more permissions than their abilities and experience can handle, they can cause many unintended damages.
Happiness is a Double-Signed Check
Segregation of duties (SOD) regulation is directly linked to unnecessary permissions. SOD, in a nutshell, protects vital processes from undue interference by any entity or community. To put it another way, important process activities must be spread across individuals and departments to maintain checks and balances and ensure the validity of results.
We know in accounting that giving one person the authority to print and sign checks is a bad idea because it makes it too easy to write fraudulent reviews. We know there are places in IT where similar conflicts of interest exist. We choose not to give users the ability to be security or system administrators, developers the ability to test, or our developers’ ability to upgrade production systems.
Organizations must first assess which IT services are essential and set appropriate risk thresholds before discussing permissions with SOD. From there, functions and responsibilities can be examined to see what combinations result in an overabundance of permissions.
Avoid any approvals that place the process’s confidentiality, honesty, or the availability in jeopardy. When protection is breached, tasks must be redistributed, or compensating controls must be implemented to reduce risk to a manageable level.
Also, keep in mind one crucial thing about employees’ egos: When reviewing required changes, keep in mind that many emotions always accompany approvals. To support the organizational change, training and awareness programs will be needed.
Excessive permissions explicitly placed companies at risk. Roles must be checked regularly to ensure that the company is adequately served by separation of duties, and system privileges must represent the specified roles. Security is becoming more critical in today’s world, and authorization models must reduce risks to the degree that management is comfortable with.