Least Privilege Best Practices: Where to Start

A hospital in Portugal gave every single employee doctor-level access.

That means the janitor could read your medical chart.

That cost them 400,000 euros in fines, and when they appealed, the

court basically said they didn't even try the concept of least privilege.

Today, that's what we're talking about, least privilege best practices.

What does that mean exactly?

And, and also, where do you start when everybody already has domain admin?

Finally, we talk about role-based administration and why that's

really the only realistic path here.

We talk about privileged account inventories, uh, fire call accounts,

segregation of duties, non-repudiation, and three backup roles that you should

split apart before somebody quietly deletes your backup configuration.

If this is your first time watching or listening to me, I'm

W. Curtis Preston, AKA Mr. Backup.

I've been obsessing over backup recovery, and now cyber recovery, for over 30 years.

If that's your bag, I'm your guy.

You're not gonna find anybody that cares about it more than me.

Ever since 1993, when I had to tell my boss that there were no backups of

the database that we had just lost.

Now I've written five O'Reilly books, a blog, and now this podcast.

Here, we turn unappreciated admins into cyber recovery heroes.

This is the Backup Wrap-Up

Hi, and welcome to The Backup Wrap Up.

I'm your host W. Curtis Preston.

I'm joined by the two greatest ever on the… I don't know.

I don't know what I'm gonna say.

Anyway, I'm joined with,

Ever, Curtis?

Ever, ever?

Ever, ever, ever, at least this week on a Thursday, on a

Tuesday or what- whatever it is.

It's a Monday.

I don't know what's going on in my head.

Hi, Prasanna.

Hi, Curtis.

I have a question for you.

Yeah

Is your poster crooked with your latest book that you and Mike wrote?

No,

The angle

It's the angle of the shelf.

The shelf is a

'Cause I was going off the right-hand side where the book

meets up with the other two books.

For those of you who don't know, you can watch us on YouTube.

We do have the videos posted, and you can see the giant… Imagine

if they made the book that size.

That would be pretty awesome

Does that

It'd be heavy

No, that makes it worse, didn't it?

No?

I literally think it's a, I think it's an optical illusion.

But you know what?

Just for you, I will go find a, a level and, we'll fix it in post.

me happy, Curtis.

yeah.

you're… and then we have my co-author of this book that was hanging on the

wall that seems to have gone back to its original position, which for the record

would imply gravity and that it was in the right place in the first place.

Learning Ransomware Response and Recovery, Mike Saylor.

How's it going, Mike?

Well, look forward to digging into another one with you guys

Mike,

So we're…

I have a, question for you, Mike.

Does it look crooked to you?

That's…

Okay.

I've got a… Don't make me go downstairs and get a level.

I don't think I have one over… wait.

You know what?

Your phone.

Your phone

I have my iPhone

I think the bottom left corner for you, Curtis, when you face

it, needs to go to the left

put this right… Why is it beeping?

I'm gonna put this right here

It says 0% right now.

Yes.

it looks better

Now it looks straight.

Now it's crooked

looks crooked.

See?

Look straight to us now

See what I mean?

I'm you.

If it's off by 1%.

I'm just saying.

It's noticeable

My God, we've already spent 20 minutes on this.

So let's go, let- So we're, today we're gonna be talking about the concept of

least privilege, and to illustrate the concept of least privilege, I'm gonna

tell a story which I've mentioned a couple of times on the podcast, which

is, this hospital in Portugal that is, that received a, a huge fine,

back, let me just double-check here.

Yeah, it was 2018, right?

So this is the EU Data Protection Law, GDPR, the General Data Protection

Regulations, and, they, require that you implement the concept of least

privilege and among many other things.

And they discovered that this hospital, d- slightly didn't adhere to that, in

that what they found was easier, in this hospital, was that all employees

in the hospital got doctor-level access.

So that way, everybody, including the janitor, had access to

literally ev- the most private data, in, in the entire, hospital.

And so they found that,

including patient records

including patient records and everything, right?

And, the, and, th- there are different levels of access to patient records

even withi- within a hospital, right?

And then, and obviously there are people that don't need

any access to patient records.

And, why are you doing that thing?

You're doing

No, no,

you agree

a

me

qu- no, because it was going through my head, and maybe before we go onto

the actual topic, is it worse to give everyone admin access or to just

use the same password for everyone?

it's roughly the same thing, I'm su- I'll say it's probably worse to get

everybody the same password because, that means that if somebody does

abuse their privilege, there won't be any logging of it whatsoever.

the whole point, and by the way, they were fined 400,000 euro and, they appealed

it, unsuccessfully they appealed it.

And, the EU, courts found that, they d- it was like they didn't even try,

was basically they're like, "You di- you guys didn't try and fail. You

basically said, 'This sounds like a great concept. We're gonna completely

ignore it altogether.'" and just think about the kinds of things that are in a

medical record and, and thinking about the fact that the jan- that the janitor

had access to your medical records, right?

And Mike, have you, in all the consulting you've done in helping out

all these other companies, have you ever encountered anything that bad?

I hope not.

I would hope that never, that you've never seen that, but

Yeah.

And I've even seen it in healthcare.

and it wasn't just logical security, security was bad also

Yeah, depressing.

Yeah, you'd think that like with some, you would think s- with some, industries

like medical or finance, I'd say those are two where you've got some really bad

things will happen if the data gets out.

You would think that they would know what they're hap- that they're doing,

but again, I've also worked in, in finance and in, a number of areas where

they should really know better, and they absolutely clearly did not know better.

first off, d- Mike, do you wanna just define, Actually, we're g-

we're gonna go, we're gonna go for you the, for the deeper stuff.

Prasanna, I think you can define this for me.

what is the concept of least privilege?

It basically says if you are a user, you only have access to

things that you need and that is it.

So if you are a janitor, you don't need access to patient records.

If you're never touching like backup systems, you probably shouldn't be able

to go create delete backup policies.

And making sure you scope your permissions such that you only get access to the

things you need in order to do your job

So you're given the least amount of privilege, which is

too long to say that, right?

You're given the least amount of privilege that you need in

order to do your job, right?

Which is where we get the concept of least privilege.

and if we wanted to dig a little deeper in that, Mike, which we do,

h- how do we go about doing this?

Like, where do you start with this?

there's a lot of different ways to go about it.

It, company culture's gonna probably drive, what's most appropriate.

so from a, just a normal especially if you're the new guy and you can just blame

it on being new, just turn everything off and see who screams about access to what.

so that's one way.

the other way is a true analysis of job role.

and so it's not just, the different areas that I have access to, it's the

levels of access within each area.

So you've got a data entry clerk that doesn't need to have the ability to

approve a purchase order, but they still need access to the accounting system.

But you've got people in marketing that don't need

access to the accounting system.

They need access to certain websites, maybe websites that other people in

the company shouldn't be able to go to.

so there's the, turn everything off and wait for people to ask.

There is the, turn things off in a somewhat logical manner.

And then there's the, let's start from scratch with understanding the

different types of users and roles we have, and then work with those

departments and people to define what access is appropriate for those users

I

That seems

my, mom did medical transcription for, for many years, right?

And she therefore had technically had access to patient records,

but literally one patient at a time and only to that record.

So d- they could have given her access to the entire, that patient, but she

literally had access to that patient at that time to create that patient's record,

which was then put into the system.

She wasn't given access to access all of… So that's a perfect example

of where she does need access to, the type of information, but she

doesn't need access to all of it.

Now Prasanna, about to ask something

W- d- you actually brought up a great example, Curtis.

she had access to that system.

But now if I think about, an enterprise or an organization, they probably have

hundreds of applications out there, hundreds of systems, each using their

own different, potentially different role and permission-based systems.

Eh, how do you even go about doing the, options two or three,

Mike, that you talked about?

turning everything off just seems so much easier until someone complains

than trying to do, this fine-grain mechanisms, like either of the

fine-grain mechanisms you talked about

Well, use- user access management is, resource intensive regardless

of which way you go about it.

if you turn everything off, you should have a good help desk, right?

'Cause you're gonna get phone calls.

Now, Mike,

If, if-

to that, you really need support from on high if you're gonna do that method,

Yeah,

Because you're

for sure

you're going to impact services, right?

the… Yeah, go ahead

and I've got a story about a disgruntled desk person that was berated by an

executive for that very reason, and it

Oh, no

well.

then, all right, so then, options two and three, where you're going

about it a little more methodically, there's resources not only up front

to go and define all these things, but in all three cases, how are we

gonna manage this going forward?

Bob doesn't… Bob transferred from accounting to HR or from marketing

to sales or from IT some other role.

We've gotta make sure there's a way of communicating those changes so that

changes to their access, follows them.

there are ways that there's human ways of doing that, so every

month I'm running a, an analysis or we implement tools to do that.

A, a lot of HR systems as a person's job role changes or their status

changes, there's a workflow for that.

there's automation in Microsoft products, that you can define workflows

f- for, but it all takes a, a bit of strategy and resource planning, and a

lot of organizations just don't do it

Yeah.

and, and they suffer as a result, right?

and so th- there's a word that's come up a lot in your, in your answer,

which is the word role, right?

R- R-O-L-E, role, and which brings up a, a very related

topic was, which is role-based administration controls, or RBAC.

I think that's really the only way that you can get… if you're gonna, if you

have any hope of getting this done, it's y- it's by defining roles of the

different organizations, different parts of the organizations, different levels

within the organizations, and then saying, "This person has moved from A to

B. They're no longer in A, they're now in B," and you give them this new role.

any thoughts on that?

Completely agree.

And that's something that you can do over time as new users come in.

Bob needs access to X, Y, and Z. Was that consistent with Bob's coworkers?

If so, I can save that as a profile for that role.

So now when Bob leaves and Susan comes in, I don't have to go

reassess what Susan needs access to.

I just apply a role to her and then address any exceptions.

She needs access to the check printer or a certain website or…

So those are one-off exceptions, and you'd wanna document those.

But for the most part, you can define roles that way and simply assign

them to people as they fill that role or as that role becomes defined.

And then maybe Bob didn't leave the company, Bob went to another department.

is there already a role for that?

And if not, I'll define one or save whatever I create for Bob as that role.

so there are ways to do it.

You just need to do it

it does start with that mindset, right?

That you're like, that this is a good thing, that we're gonna do

least privilege, that we're gonna do, and the, and that the vehicle

through which we're gonna do least privilege is role-based administration.

And so when you have a new user, when you have a change in your user, like you

said, you don't just go and add them.

You go and you create a role, for that user.

Even if it's just one, at least at that point it's just one.

when that person leaves or that person gets promoted and you put another person

in, theoretically you should then be able to just assign that role to them.

Prasanna, you've been, I think in your career you've been on the vendor side,

Yep.

Yep

I'm sure you've seen issues like this, on the vendor side

Oh, yeah.

as users transition in and out of roles, like we talk about

backup apps all the time, right?

You have different levels even within backup apps.

You have the person who's responsible for restoring, right?

Being your sort of tier one support, right?

And then as you look up to, the people who are managing

policies and super admin, right?

All those different roles.

But then also within organizations themselves, like when I was

working at a vendor, right?

It's not oh, I had an individual role for me.

It was like, oh, I'm part of product org, or I'm part of the engineering org.

I'm gonna be assigned to that role, and whatever they get

is the access that I needed.

And one question I know, Curtis, you made at the point about yes,

you should go create a role for an individual if it didn't exist before.

But I think you have to also ask yourself, is creating a role the right thing to do?

Because if you go down that path, there is a possibility that you

could say, "Okay, Curtis, you need this extra role or privilege.

Mike needs this other privilege," even though, 99% they might be the same.

And so I think you also need to worry about the sprawl in terms of

the number of roles, managing the roles, and everything else like that.

So just the…

Creek

Yeah.

Yeah, I think the way to do that is at least, in my thoughts, the way to do that

is to find out what's the 90%, right?

The 80/20 rule, right?

To find the roles that, Mike works in IT, right?

Mike works in this part of IT, and therefore he needs these privileges that

everyone who works in IT works in, right?

or that every wo- everyone who works in IT has, right?

and even if you have… I don't think it's a good idea to create a role… I

just said create a role for one person, but what I mean here is I don't think

it's idea to create a custom role for each person in the organization, right?

To create…

You wanna create a role that fits the most people, and then you add

exceptions, to that, to that role.

Maybe that's another role.

Maybe it's just another, what do you call that?

ad hoc.

Maybe it's just another ad hoc permission that you're added on.

again, this is one of those things where it's like a lot of other things that it

does require a lot of work upfront, and I think that's a really good question

that you ask, Prasanna, is that we don't want… Not everybody does an I- not

everybody in IT does the same thing, and so we don't wanna create 37 roles.

I think we can create roles that are really important and that really

need to be reserved, and that we only give those permissions those people.

a domain admin?

What's…

Yeah.

Everyone gets domain admin.

What do you think, Mike?

or local admin.

But yeah, lowest common denominator per role is a great, is a good approach.

and what's interesting is, from a… and so acc- access and access, the

appropriateness of an access, of access, and the process that you go

through to and assign that access is what we would call a control from

an audit and governance perspective.

if you look at the business side, accounting, finance as an example, have

controls called segregation of duties.

So I can't be a requester and an approver in the accounting system.

So the accounting system itself already has roles defined that address

segregation of duties, concerns, controls.

We've tried over the years to apply that to IT, but we s- we

sh- as IT practitioners, we so fight, wanting anything to do

with how business does its thing.

quite similarly, they don't wanna do anything… they try.

But they wanna be separate from IT, The pretty people wanna be

separate from the geeks, as we used to say at one of the telecoms.

But if we could better adopt, and maybe it just takes a culture, a, a leadership

culture to start that is a- adopt that segregation of duties mindset.

as a… E- even if I had a privileged account, I should not be running my

privileged account while I'm surfing the internet or checking my Gmail, right?

I should only be using my admin account when I'm doing administrative things.

so that's actually a segregation of duties, and I think one of the

topics we may touch on is, then how do I tell what Mike did when Mike

was an admin and what Mike did when Mike was using his normal account?

that's important, too.

Which

Much like on the business side

go ahead

Much like on the business side from a transaction perspective, if I log

in as, just some generic accounting clerk and I'm doing transactions, I'm

entering deposits or I'm paying bills, and there comes an issue with those

transactions, fraud or miscalculation or I miskeyed how am I gonna know who did it?

And if I'm a, an accounting system admin and I can add new users or change

payees, and I do it accidentally, I make a mistake, but I'm logged

in as accounting system admin,

Yeah.

And

where's the accountability or the traceability of that

transaction to a person?

And when I go back to my early days, literally just everybody had root

day

What's back in the day, everybody had root, and then, when we needed

Oracle, I just logged in as root and then I SU'd Oracle, right?

Because we were big at Oracle environment.

And th- we did not have a culture of logging in as yourself

and becoming root, right?

or, using, I think sudo was a thing back then.

I think I remember, I was at a bank and we had a regulation that required

all… There was this thing that said all software wi- will be purchased from

an established vendor, which meant that open source software wasn't a thing.

And at the time, sudo, the only time you could get sudo was open source.

so I don't think we had sudo, which for those of you, if you're not

a Unix person, s- SU is the thing to become super user, AKA root.

And, sudo was like SU do, right?

it was like a do this thing as me, using my account, but do it as root.

And you could do it in such a way that stay in your account.

You don't even ever become root or administrator, but it runs that particular

command as root or administrator.

and so yeah, that, that idea, Mike, of not logging in as… Because

if you, if everybody logs in as root or Oracle or administrator,

you've got no accountability.

by the way, that, I'm gonna go over- There was a word, Mike, that was

used in this thing, non-repudiation.

that's a big word for me.

I'm gonna ask you, can you define that word or is it comp-

So you can't, you, so non-repudiation means you can't say you didn't do it

Okay.

All right.

I'm, so I'm gonna ask you that on the record.

That was more me asking you if you could, if you were comfortable.

Yeah.

Okay.

All right.

So Mike, th- this, we've been talking about not logging in as

admin and, staying, do- doing things as you as much as possible.

and one of the words that comes up, in that, when we talk about that is

this cons- concept of non-repudiation.

you wanna talk about that?

Yeah, it's, so essentially it just means that there's this transaction

log, so it could be an event log or, a log out of a, a financial system that

says you can't say you didn't do it.

it says M Saylor, time, date stamp, did these things.

can't repudiate that.

So having a control in place for non-repudiation.

and if you say it in German, it sounds really aggressive

what's the word in German?

I don't know, but just if you say it with a German accent,

it almost sounds threatening

yeah, which, also brings up this idea, if we're gonna do least privilege,

if we're going to, have this culture where everybody's logging in as

themselves as much as possible, and when they need administrator, they're

going to become administrator rather than logging in as administrator.

and, I like that word of non-repudiation.

then

There…

that we need

wait.

For…

ahead

Wait, before you go on, but in order for those logs to be like my Msaylor

did X, Y, and Z, those also need to be protected, immutable, right?

All the things that we've talked about to ensure they can't be changed

And that's, and we've talked, I'm pretty sure we've talked about that

on other episodes, but the idea that logs should be immediately sent to

some sort of log gathering system, would this… it always escapes me.

is this EDR, ACR, SOAR?

What are we looking

Fem

Mike?

Tim

What?

Oh, SIEM.

Okay.

Siem.

Yep.

So the, the

S-I-E-M

the logs need to be immediately sent to a SIEM tool, which is,

me, information… God dang it.

What does SIEM stand for?

It's

S-I-E-

security

event management

There we go.

Okay.

SIEM, which is not pronounced seam, who,

Depends on where you're from

Australians

SIEMonster, that's why they called the company SIEMonster because where

they're from, it's pronounced seam, and they had no idea that the rest

of the world pronounces it SIEM.

Anyway, just a little bit of, We had their CEO on here a while ago.

it seems like it was yesterday, but my goodness, that's probably five years ago.

so yeah, th- that has to happen because again, with- without that,

you don't have the non-repudiation, and without that, you can't have this

ability to do, to regularly do an audit, to then go in and say, "Was

anybody logging in as administrator?

Was administrator doing some things that where people were logging in?"

And by the way, another thing that you can do is you can prevent the

direct logging in of administrator, especially via remote, sessions, right?

you can say that this can only happen on the console, and then you control

that in a number of different ways.

so let's talk about some action items, Mike.

this first idea and, i- is this idea of an inventory.

h- what are we talking about there?

So what, what accounts, so those could be accounts that people log

in with, could be service accounts, it could be support accounts, and

they're also called, there, there are accounts we call fire call accounts.

So we-- those are admin accounts that break glass in the event of fire.

we need to inventory all of those and maintain some awareness of

which ones are still active.

and that should happen as often as it makes sense for your environment.

Once a year at least.

is, would be better, but if your environment experiences turnover, and

that turnover could be third parties, vendors, support, new applications, new

projects that, some big implementation or migration, or just normal employee

turnover, you need to do an assessment of that, as often as it makes sense

Are there tools to help with that, Mike?

Because I could imagine it could get very gnarly in a large organization

or a, an organization with a lot of these systems in place

There are, and it doesn't…

there, there's an IT tool for everything, and some of them are pretty pricey.

today with the evolution of Python and PowerScript, there… and there's so many

forums out there of admins that just wanna share knowledge and support each other.

are free open source scripts and tools all day long.

you just need to put the effort into finding one and testing it,

and do test it before you use it.

even Microsoft has free training on how to use the tools that come

with Active Directory as an example.

And then for those environments where there's some, it's a hybrid of,

Windows, Linux, Unix, or even macOS, both Microsoft and these open source

communities have and documentation on how to implement either scripts or

middleware third-party tools, to pull that information into one, one report

No, I would add to that inventory, you talked about mainly about

particular accounts, right?

I would add to that inventory the idea of, critical roles, right?

Because for example, and again, I'll speak specifically from

the backup software side.

we… A long time ago, we got away from having to run the backup as root, right?

Everyone's logging into the backup system as themselves, and they're

doing everything that they have.

the backup system itself is all-powerful, but when they're logging into the backup

system, they're logging in as themselves.

But in the backup world, I can think of, three, main roles that I would want to.

You, earlier you talked about the idea of segregation.

If possible, I would like to segregate these.

One of is the ability to the backups, right?

To configure the backups, which would mean adding things to

the backups, more importantly, taking things out of the backups.

also extending retention, reducing retention, right?

the, just, or just completely deleting an entire configuration

from the backups, right?

that's one.

The second would be like running the backups, like making sure that the backups

are running, the ability to run one if it's not, if it didn't work last night.

Also, the ability to report on those backups to figure out, what's working

or what worked or didn't work.

And by the way, going back to that, the reason why it's really important,

if possible, to segregate that, the editing from the running is that,

and, is that when someone, takes something out of the backups, person

running the backups quite possibly is not going to a- ever see that, right?

because what happens is they get exception reporting.

They don't… and even if they get success reporting, they generally

ignore the exis- all the successes because they get thousands of those

a night, and they don't get a failure something didn't run anymore, right?

They don't see that, right?

And so we wanna have that, the idea of editing the backups be a very

big thing and that's logged anytime, when it goes into that role and

does anything, so that gets logged.

And then the third would be, of course, restores, right?

If possible, if we can segregate those three different roles, because why are

restores, a po- a, an issue, especially when we're talking about the kinds

of things we talk about, Prasanna?

Because you can have a bad actor who restores data to some

location or other things like that

Yeah.

Remember, our friend, Mr. Red Hat,

Yes

Dwayne LaFlotte.

Remember he talked about he restored an active directory server, an

active directory, a domain controller to some other area, and then he

had all the time in the world to hack against that thing, right?

and of course, it can also be used to exfiltrate just anything

if you're able to do a restore.

Because the, the other thing, one of the real concerns with

backups and with restores is that they fall under the radar.

a restore isn't gonna set off an alarm, quite possibly in, some

sort of, event management tool.

It's not gonna… It's gonna, it's gonna show up as regular.

and maybe it should.

maybe all restores should trigger some sort of report so that at least we

know, somebody can double-check and make sure that we did the right thing.

But, but that's the issue with restore.

So my point, all of that was to just say we need to inventory these roles.

There are dozens of those roles throughout the environment,

not just the backup stuff.

application access, records access, access to things like security controls,

network controls, server controls.

All of these things have roles that you can define them and segregate those,

or inventory those as much as possible.

So

the,

I think…

go

ahead

wait.

I have one thing, sorry.

Going back to Mike, I know you mentioned you wanna periodically

inventory these things, right?

Or audit, right?

To make sure that people have the right roles and you're doing the right things.

I'm wondering though, as you start to tie roles with, Curtis, what

did you say the other thing was?

Roles with… You had another piece that you put in there.

administrative accounts?

Yeah, with the accounts, which I think you should also bring in, the

resource themsel- or itself, right?

Like for instance, if it's this role with this type of account accessing,

say, an AWS resource, right?

and looking at it end to end.

I think those are the sort of things you probably wanna have, like some sort

of automation, because resources might get spun up quickly or brought down,

or even virtualization environments, to always make sure that what is actually

getting assigned matches, like what should be there, rather than just looking at

it more from an auditing perspective, but like an ongoing running basis.

What do you think of that, Mike?

th-there are tools for that.

a lot of the, a lot of the implementation of those tools I've seen fall off

over time because it's just more work.

you've got a tool.

The tool populates based on Active Directory primarily, unless you've

got something like Samba or some other middleware that's pulling out

of the Unix and other environments, you're not gonna see that in the tool.

So there's something else that just complexity.

right, then, if you don't have the tool that consolidates that into

one view from a user perspective, then you've gotta log in to or at

least review each one of these.

You've gotta review in Active Directory all these different accounts, to see if

there's notes or expiration or whatever.

so long story short, however you decide to do the inventory, to your point,

it needs more than just, "Here's the name of the account and the level of

privilege." It also needs to include, why did, why was this, created?

What's the description?

What's the reason?

Who's the stakeholder?

Who owns this?

Is IT, cis admin?

Is it networking?

Is it the security guys?

Is it the business?

'cause it, it could be anybody.

So when we're doing this review, again should happen as often as necessary

or appropriate, I'm reviewing this particular account to determine if that

role is still appropriate and then who has access to this, to this account.

There could be any number of other fields to track, when's the last time

this account's password was changed?

is there a defined expiration for this account?

'Cause maybe it's something I set up for a, a vendor to do an implementation

or help me, do whatever, and, I'm gonna auto-expire it 90 days from

now just so that I don't have to worry about it between now and then.

when's the last time someone reviewed this account?

So there's a lot you could track.

And if you do that in one place, and even in small environments,

you've probably got a dozen or more of these privileged accounts.

If you didn't have a good way of tracking and inventorying and man-managing all

of those, you've gotta go into each one of those accounts manually to review

notes and settings and other things

this, still just call it a spreadsheet for now.

you mana- as you manage the spreadsheet, you're only having to manage changes to

one or m-more, not all of them probably.

And then you just go back into your Active Directory or your

system to update that vice versa.

Yeah.

and you touched on one final thing that we were gonna talk about,

and that is this idea of expiring accounts that aren't being used.

because th-there was a story that we covered a little while ago

where somebody used an account that hadn't been used in a long time.

Do you remember that, Prasanna?

and we said, if they just had, automatic expiration of accounts, have happened.

But,

that one

yeah.

and that, that's true of a, of special account or that's true of a special

privilege that you one-off that you gave somebody like you, Mike, you talked about

with the vendor, that things like that should definitely have an expiration date.

All right, so the idea of least privilege, good, right?

you should have the least amount of privilege you need to do your job,

and you should, inventory this as much as possible, inventory the accounts

that have these special privileges, inventory the special privileges

and different functionality that you have and where all of that, is used,

and then put all of that together.

And then, slo- it can start with a simple, inventory and that

inventory can be a mess, right?

Here's Curtis and here's the 1,700 different things that he has access to.

and then you start putting, trying to put that together

to, to move towards role-based administration and least privilege.

it's going to be an effort, but, I would say one that's well worth it.

Any final thoughts on that?

I'll add real quick that if you're in an environment where admins are

against this idea of least privilege and against the idea of inventorying

accounts for… If you're getting any pushback at all, you should be concerned

Go to a new company?

Yeah.

it's like in, in the backup world, like if you're having to argue with senior

management that RAID is not a backup, maybe you should be somewhere else.

all right.

or if they're pushing for, RDP really needs to be, internet facing.

Accessible from the internet?

Yeah.

yeah, exactly.

All right.

that is, Oh, wait a minute.

so again, thanks for coming on, Mike

Anytime

And, Prasanna, thank you too as well

Thanks, Curtis.

I think after this, if you can adjust the poster, I wanna say

it's like a millimeter maybe.

Your bottom left corner needs to go left about a millimeter

I'm American.

I do inches and s-

Oh, sorry, the bottom right corner.

Yes

okay.

I'll see what I can do there.

All right

Thanks for listening, folks.

That is a wrap.

The Backup Wrap Up is written, recorded, and produced by me, W. Curtis Preston.

If you need backup or DR consulting, content generation, or expert witness

work, check out backupcentral.com.

You can also find links for my O'Reilly books on the same website.

Remember, this is an independent podcast, and any opinions that

you hear are those of the speaker and not necessarily an employer.

Thanks for listening