BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

What Hackers Don’t Want You To Know About User Privileges

Posted March 9, 2011    Peter McCalister

Believe it or there are people out there that aspire to be hackers.  Not just the run of the mill, crack a password or two, but a bona fide Neo who can play with your secure data like a personal version of the matrix.

These would be data pirates and malcontents have websites that teach them their craft and even annual conferences like DEFCON to compare tips, tricks and vulnerabilities.  They are more organized than the average business executive or auditor realizes and they are inspired by nothing short of total access to any and everything on the information super highway, especially what is hidden within your  servers and on any one of your user’s desktops.

The recurring theme and core principal is basically to find access to admin credentials and you own the keys to the kingdom.  So, when users are granted excessive privileges (admin on desktops, root on servers) then you have an environment just begging for a hacker to attack.

Patient to Doctor: Doctor, doctor, when I do this it hurts

Doctor to Patient: Then don’t do it!

Sage advice that hackers don’t want you to know: if you don’t grant admin rights, you don’t run the risk of someone stealing them, hijacking them or even intentionally misusing them from inside.

Leave a Reply

Additional articles

randy franklin smith

At the End of Day You Can’t Control What Privileged Users Do: It’s about Detective/Deterrent Controls and Accountability

Posted March 31, 2015    Randy Franklin Smith

Live Webinar: Thursday, April 2, 2015 | 10am PT/1pm ET | REGISTER NOW! In this webinar, Security Expert Randy Franklin Smith will look at how to audit what admins do inside Linux and UNIX with sudo’s logging capabilities.

Tags:
, ,
BA_Hacked

British Airways Executive Club Member Accounts Hacked

Posted March 30, 2015    Brian Chappell

British Airways has released information regarding the hacking of a number of their Executive Club (BA’s frequent flyer programme) member’s accounts.

Tags:
, , ,
webinar_ondemand

On Demand Webinar – Why You Still Suck at Patching

Posted March 27, 2015    Lindsay Marsh

On Demand Webinar: Dave Shackleford recounts some of his personal experiences in patch management failure, and breaks down the most critical issues holding many teams back from patching more effectively.

Tags:
,