October 29. Admin Controls & Accounts
Administrator accounts (often called "privileged accounts") are the most powerful and, so, the most sought-after targets for cybercriminals. These accounts hold the "keys to the kingdom," possessing extensive permissions to configure systems, access sensitive data, manage users, and make critical changes across an entire network or application. A single compromised admin account can lead to a catastrophic data breach, widespread system paralysis, or complete organisational takeover by attackers. Therefore, making these accounts cyber resilient through controls, processes, and procedures is crucial.
Why Admin Accounts Are High-Value Targets
Cyber criminals prioritise compromising admin accounts because they offer:
-
Widespread Access: The ability to access and manipulate virtually any system, application, or dataset.
-
Persistent Footholds: The power to create new accounts, backdoors, or disable security measures, ensuring long-term access.
-
Data Exfiltration: Unrestricted access to sensitive intellectual property, customer data, and financial records.
-
System Disruption: The capability to deploy ransomware, wipe data, or shut down critical infrastructure.
Best Practices for Admin Accounts
Achieving resilience for admin accounts requires a multi-faceted approach, combining robust technical controls with strict administrative procedures.
1. Implement Strict Access Controls and the Principle of Least Privilege (PoLP)
-
Dedicated Admin Accounts: Never use everyday user accounts for administrative tasks. Each administrator should have two distinct accounts: a standard user account for daily activities (email, Browse) and a separate, highly restricted administrator account used only for elevated tasks.
-
Principle of Least Privilege: Grant admin accounts only the absolute minimum permissions necessary to perform their specific administrative functions. Avoid giving "global admin" rights unless absolutely essential for a very limited number of roles. Review these permissions regularly to ensure they are still appropriate.
-
Role-Based Access Control (RBAC): Define specific administrative roles (e.g., "Network Administrator," "Database Administrator") and assign permissions based on these roles, rather than granting individual privileges. Assign users to roles, not direct permissions. Don't give staff permissions for convenience, for example.
2. Enforce Robust Authentication
-
Mandatory Multi-Factor Authentication (MFA): This is non-negotiable for all admin accounts. Go beyond basic SMS-based MFA, which can be vulnerable to SIM-swapping. Consider stronger methods like:
-
Authenticator Apps: Time-based One-Time Passwords (TOTP) from apps like Google Authenticator or Microsoft Authenticator.
-
Physical Security Keys : Hardware tokens like YubiKeys provide the strongest form of MFA and are highly resistant to phishing.
-
-
Complex, Unique Passwords: Even with MFA, enforce extremely long, complex, and unique passwords for admin accounts. These should never be reused anywhere else.
-
No Shared Accounts: Each administrator must have their own unique admin account; never share credentials.
3. Implement Privileged Access Management (PAM) Solutions
For organisations, a Privileged Access Management (PAM) solution is a game-changer. PAM tools:
-
Centralise Credential Management: Securely store and rotate privileged account passwords, preventing direct access by administrators to the actual credentials.
-
Just-in-Time (JIT) Access: Grant temporary, time-limited elevated privileges only when needed for a specific task, automatically revoking them afterwards.
-
Session Monitoring and Recording: Monitor and record all activities performed by privileged users, providing an audit trail for forensic analysis.
-
Least Privilege Enforcement: Integrate with other systems to enforce granular permissions.
4. Establish Strict Processes and Procedures
-
Regular Audits and Reviews: Conduct frequent audits of all administrative accounts. This includes:
-
Reviewing permissions to ensure they align with current job roles.
-
Identifying and disabling dormant or inactive admin accounts immediately.
-
Checking for any unauthorised creation of new admin accounts.
-
Reviewing logs for suspicious login attempts or activities.
-
-
Leaver Procedures: When an administrator leaves the organisation, their admin accounts (and all other digital access) must be immediately revoked or disabled as part of a formal offboarding process. This should be a top priority.
-
Onboarding Procedures: For new administrators, ensure they are provisioned with dedicated admin accounts, appropriate PoLP, and mandatory MFA from day one.
-
Change Management: Any changes to administrative accounts or their permissions should follow a formal change management process, requiring approval and documentation.
-
Emergency Access Procedures: Establish a secure, documented "break-glass" procedure for gaining emergency access in the event of an outage where normal admin accounts cannot be used (e.g., a hardware token is lost). This access should be highly controlled and audited.
-
Segregation of Duties: Divide critical administrative tasks among multiple individuals so that no single person has complete control over a sensitive process. For example, the person who approves new users shouldn't be the same person who creates the accounts.
5. Continuous Monitoring and Alerting
-
Audit Logging: Ensure comprehensive logging is enabled on all systems for all activities performed by admin accounts.
-
Centralised Logging and SIEM: Collect all logs into a Security Information and Event Management (SIEM) system for centralised analysis, correlation, and real-time alerting on suspicious activities (e.g., multiple failed admin logins, admin login from unusual locations, creation of new admin accounts).
-
Anomaly Detection: Implement systems that can detect unusual patterns in admin account behavior.
6. Regular Security Awareness Training (for all users, but especially admins)
While admin accounts have high technical controls, the human factor remains. Administrators should receive enhanced, targeted training on:
-
Advanced Phishing & Social Engineering: How attackers try to trick privileged users.
-
Secure Remote Access: Best practices for accessing systems remotely.
-
Incident Reporting: How to immediately report any suspicious activity or potential compromise.
By meticulously implementing these best practices, processes, and procedures, organisations can significantly reduce the attack surface for privileged accounts, contain the impact of potential breaches, and build a truly resilient cybersecurity posture.
💡Today's Cyber Tip: Secure Your Admin Power!
If you have an admin account at work, never use it for your everyday tasks like checking email or Browse the web. Only use your admin account when you absolutely need its elevated privileges, and always use a strong, unique password and Multi-Factor Authentication (MFA) for it. Keep your powerful keys separate and locked down!
Consider regularly reviewing who is control of the admin passwords. Make it part of the onboarding and leavers process with staff. If an admin staff member leaves, ensure the password is changed and kept securely.
🛂 Are the senior leadership aware of who has the admin passwords or at least know how to access them?
🛂 If IT is outsourced, ensure that the organisation still has copies of all admin passwords locally.
🛂 If the IT provider is changed, ensure relevant passwords are changed, once the new provider takes over.
Have you done a due diligence check on your IT supplier, after all they will have access to all of your sensitive and private information?
If you are a school or multi academy trust there is more about access control in the DfE Digital Standards for schools and colleges. We can provide support, guidance and trackers to assess where are you are and monitor your progress 👉 https://digitalstandardstracker.co.uk/
Our customers can check our generic third party list to see if we have already done any due diligence on a third party, or they can request it by emailing
Review: NCSC Password administration for system owners
Review DPE's previous articles about admin controls:
{article title="October is Cyber Security Awareness Month: 17. Access Control (Users)"}[link][title][/link]
[readmore]{/article}
DPE Knowledge Bank Guidance and Support:
For schools and colleges, six of the DfE Digital Standards are now mandatory. We have a DfE Digital Standards Tracker tool help you track your cyber resilience and your progress:
Review our Cyber Security Best Practice Area for micro learning, support, guidance and policies:
Why not have a look at our 'specialist' trainer Harry the Hacker :
