4 ms·

Kind of like sudo. Your individual identity is allowed to assume the privileged identity after providing an additional factor/justification (and your access has

by cmckn 2y ago

Kind of like sudo. Your individual identity is allowed to assume the privileged identity after providing an additional factor/justification (and your access has a TTL).

turbojet1321 2y ago
Sorry, I meant in an actual corporate (ie, Windows) environment, not conceptually.
- kevindamm 2y ago
  My solution is: don't use AD for anything privileged in production, route all privileged operations through SSO auth and have the operation executed by servers in production. Separate corp and prod. Add a zero trust layer so that every single privileged operation involves an auth challenge (which can be assisted by an OTP dongle so that users aren't required to re-key their passwords multiple times per 20-ish hours).
- epiecs 2y ago
  You use PIM: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure https://learn.microsoft.com/en-us/entra/id-governance/privil... Basically you are eligible for your admin roles but you have to activate them first. Usually there are additional checks + notifications to other admins. These permissions are also only available for a set amount of time and then you will need to re request them :)
  - sfn42 2y ago
    I don't understand the point of PIM. If some malicious actor has my token or controls my PC then what's stopping them from PIMing? Seems to me like it wastes my time more than anything else.
    - epiecs 2y ago
      Good question actually! There are multiple layers that add to the security: - Your login session as a user is normally valid for a day (~10 hours). But a pimmed session that gives you global admin permissions can be for example capped to max 1 hour. - A normal login as a user can just require login + mfa. But if you want to PIM to certain admin roles you for example are required to use your yubikey as well. Yes it's an extra step but if your account is hacked they only have access to you as a user and not you as an admin unless they also capture your security key. Also it creates some additional awareness for admins that they are now handling the keys of the kingdom and that the role that they just activated can do a lot of harm. In some organizations users get an admin account without fully understanding the consequences. - It is way easier to audit. In normal circumstances a user's admin permissions are "always on". Once you start using pim you can also audit when and where additional permissions where requested. This is especially handy when you are monitoring everything and you get an alert saying "Hey sfn42 just requested global admin from a location that they normally do not request this. Can you look into this to make sure that it is legit?" With always on permissions this becomes way harder. - Easier to manage via groups. You can have groups tied to eligible permissions and subsets of permissions. This is really handy once you start having external consultants who can request permissions via IGA (Identity Governance) policies. Basically consultants can go to a url (https://myaccess.microsoft.com/ https://myaccess.microsoft.com/) and request an "access package" that might contain 1 or more roles. For example somebody who has to audit certain items in our organization can request a package that contains the needed admin roles and get automatically added to the correct groups. Once they request that package we can have automated processes (with multiple stages if needed) that first contact the teamlead of that person, and later on maybe another group of person(s) to approve that access. These groups have access reviews done by the security team / app owner (weekly/monthly depending..) to make sure that all accesses are still needed. It is also really easy to let these permissions expire. So our auditor will have a valid account for the entire year but will have to re-request their permissions every 3 months (or whatever we choose). This is also _really_ easy to audit :) - When someone in our security team requests a role the rest of the team automatically receives an email so we know what is going on with our collegues :)
      - 2y ago
- tame3902 2y ago
  In my company the official policy is that nobody but the admins gets administrator privileges. If you need them the workflow is that you go to IT and they do what is necessary. Or they just might say no. People had to complain that makes work impossible for them and will cost the company a lot of money so that they got exceptions -- but only after escalation to upper management. I think this was a security directive that came from the top.

by cmckn 2y ago

Kind of like sudo. Your individual identity is allowed to assume the privileged identity after providing an additional factor/justification (and your access has a TTL).

turbojet1321 2y ago

Sorry, I meant in an actual corporate (ie, Windows) environment, not conceptually.

kevindamm 2y ago
My solution is: don't use AD for anything privileged in production, route all privileged operations through SSO auth and have the operation executed by servers in production. Separate corp and prod. Add a zero trust layer so that every single privileged operation involves an auth challenge (which can be assisted by an OTP dongle so that users aren't required to re-key their passwords multiple times per 20-ish hours).
epiecs 2y ago
You use PIM: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure https://learn.microsoft.com/en-us/entra/id-governance/privil... Basically you are eligible for your admin roles but you have to activate them first. Usually there are additional checks + notifications to other admins. These permissions are also only available for a set amount of time and then you will need to re request them :)
- sfn42 2y ago
  I don't understand the point of PIM. If some malicious actor has my token or controls my PC then what's stopping them from PIMing? Seems to me like it wastes my time more than anything else.
  - epiecs 2y ago
    Good question actually! There are multiple layers that add to the security: - Your login session as a user is normally valid for a day (~10 hours). But a pimmed session that gives you global admin permissions can be for example capped to max 1 hour. - A normal login as a user can just require login + mfa. But if you want to PIM to certain admin roles you for example are required to use your yubikey as well. Yes it's an extra step but if your account is hacked they only have access to you as a user and not you as an admin unless they also capture your security key. Also it creates some additional awareness for admins that they are now handling the keys of the kingdom and that the role that they just activated can do a lot of harm. In some organizations users get an admin account without fully understanding the consequences. - It is way easier to audit. In normal circumstances a user's admin permissions are "always on". Once you start using pim you can also audit when and where additional permissions where requested. This is especially handy when you are monitoring everything and you get an alert saying "Hey sfn42 just requested global admin from a location that they normally do not request this. Can you look into this to make sure that it is legit?" With always on permissions this becomes way harder. - Easier to manage via groups. You can have groups tied to eligible permissions and subsets of permissions. This is really handy once you start having external consultants who can request permissions via IGA (Identity Governance) policies. Basically consultants can go to a url (https://myaccess.microsoft.com/ https://myaccess.microsoft.com/) and request an "access package" that might contain 1 or more roles. For example somebody who has to audit certain items in our organization can request a package that contains the needed admin roles and get automatically added to the correct groups. Once they request that package we can have automated processes (with multiple stages if needed) that first contact the teamlead of that person, and later on maybe another group of person(s) to approve that access. These groups have access reviews done by the security team / app owner (weekly/monthly depending..) to make sure that all accesses are still needed. It is also really easy to let these permissions expire. So our auditor will have a valid account for the entire year but will have to re-request their permissions every 3 months (or whatever we choose). This is also _really_ easy to audit :) - When someone in our security team requests a role the rest of the team automatically receives an email so we know what is going on with our collegues :)
    - 2y ago
tame3902 2y ago
In my company the official policy is that nobody but the admins gets administrator privileges. If you need them the workflow is that you go to IT and they do what is necessary. Or they just might say no. People had to complain that makes work impossible for them and will cost the company a lot of money so that they got exceptions -- but only after escalation to upper management. I think this was a security directive that came from the top.