There is nothing more dangerous for an organization than a collaborator with greater access to data and resources than it needs. Attacks that occur in organizations are largely due to collaborators with malicious intent. Working from home has become the norm around the world thanks to COVID-19. Consequently, companies that adopt this practice have to pay close attention to what permissions each user has and if he really needs all of them. This guide will help you know about the «least-privilege model», which in Spanish means «least privilege model».
What is the “Least Privilege Model”?
We should not only worry about the type of user that is and the permissions that it requires. On the other hand, we must understand that a good part of these work and communicate through a variety of devices. There are organizations that adopt the Bring Your Own Device practice (bring your own device). The latter allows people with a personal device with adequate resources to be used for the tasks of their organization.
For these and various other circumstances, we must comment on this model. It is changing the way of working of millions of people around the world . It works by restricting access rights to the minimum necessary for a user to carry out their work. One of the implications is that you do not have to manipulate Active Directory Domain Administration (Windows) rights. Also, you should discard the implementation of root access to operating systems. On the other hand, an administrator-level permission will not be necessary to access a virtualization infrastructure either.
What about access privileges?
This adoption can look very promising and challenging at the same time, especially for people who work in IT. User access privileges must be permanently removed and reassigned. This is especially critical if we are talking about people leaving the organization for various reasons. Unfortunately, a common practice that is maintained is not having full visibility of those users that correspond to people who do not work in an organization. Any active user of someone who is no longer in it, can become a wide range of possibilities for cyber attacks to take place internally. The scenario is aggravated when you have a bad habit of sharing passwords between collaborators.
That same control of access privileges should be applied when people go from one job to another within an organization. Often times, people can move from one area to another. As an IT manager, you must adjust permissions, regardless of the person’s role in the company.
Suggestions for implementing the Least Privilege Model
The implementation of this model has more to do with the internal policies of each organization than with technological solutions. The first thing to do is identify what data we should protect in the first place. This be it of misuse, theft, destruction or any other event that endangers their integrity. Once you have done that, the next step is to apply Lesser Privilege Policies in order to protect said data. Consequently, each user will have restricted access (or no access) to the data according to the policies that you have created and configured. The approach has to be much more granular, that is, you have to consider all the possible variables so that there are no other or fewer permissions.
How to put this into practice? We share a couple of suggestions:
- Firewalls and VPN: This involves leaving the entire network inside the firewall. So users must always connect to a VPN in order to access a certain group of resources, applications and services according to their role. You can discriminate what needs to be accessed through VPN and what does not, in order to optimize the available bandwidth and not form a bottleneck. Above all, at times when peak traffic may occur.
- Virtual Desktop Infrastructure : In English it is known as Virtual Desktop Infrastructure (VDI) . In this way, data and applications are centrally hosted. This, in order to make them safer. If an organization has workers from home, they can log in using common tools such as a browser or some existing solution. What is achieved is an identical experience to the one in the office, not only in terms of access speed but also security. According to each user, security controls in conjunction with network policies are configured so that users have access to resources, provided they are only necessary.
Is it the same as the Zero-Trust model?
To a certain extent, they are models whose concepts are related. However, they are not the same. On the one hand, the Zero-Trust model focuses on not trusting anything or anyone. It implies, in fact, providing Least Privilege Access based on the model that is the protagonist of this guide. It is good to keep in mind that access is only guaranteed by reviewing a few considerations on each request. These are some examples: who requests access, the context or reason for the request and the risk of the environment of the requested access.
One of the central objectives of this model is to monitor any type of traffic generated by the network. In addition, the traffic generated through the APIs connected to the organization and any type of external traffic to the network are considered.
On the other hand, the Least Privilege Model focuses on restricting access rights to any entity. It does not only refer to the user and their accounts. The Least Privilege can also be applied to computing resources and processes. Now, what is a privilege after all? It refers to the authorization to the user, account or resource so that they can bypass the main security measures that cause them to have restrictions on the resources they need.
In summary, Zero-Trust refers to a network-focused security model that includes the Least Privilege Model among its implementations. And the latter is a way of managing access to the network resources of an organization. As we can see, it is clear that advances in network security evolve towards a model that allows operations and operations to become more agile and less laborious.
