Privilege creep: It's one tech term that means just what it says -- and has an appropriately ominous tone to boot. Fighting creep through privileged user management is an essential but too often overlooked security practice.
Why? It may be that, unlike many security threats, the danger posed by excess privileges is a slow-growing one. After all, longtime employees -- who've acquired expertise, historical knowledge and broad networks -- are generally an asset to the company. But as these employees change jobs or responsibilities within an enterprise, they typically acquire access to various resources, while the privileges related to their previous jobs are not revoked. In other situations, controls may be temporarily loosened on authentication and access in order to get things done -- e.g., speed up testing of in-house software development or allow employees to tweak features in programs on their own rather than rely on help desk staff to do it. Too often, the chore of tightening up these controls after the testing or tweaks have been made falls by the wayside. But setting up a system for ongoing privileged user management is too important a task to forget.
The wider an employee's portfolio of system access grows, the greater the risk. Employees with expansive privileges are a danger to company security if they become disgruntled. But even happy workers are a risk if hackers gain access to their login credentials.
Excessive and unmonitored access -- i.e., privilege creep -- is probably one of the most straightforward problems to fix. But it requires ongoing privileged user management to do so. This handbook looks at both the problem and the solution and explains why the fight against privilege creep should be at the top of any security team's to-do list.
