User Privilege Management

User privilege management represents one of the most consequential and most consistently inadequately governed security domains that the Security Consulting function encounters in its advisory engagements. The research on security incident root causes consistently identifies the privilege abuse, the compromised privileged account, and the excessive access right as the enabling conditions for the most severe security incidents, because the adversary who has obtained the privileged credential or the insider who abuses the excessive access right can achieve the objectives that the unprivileged access would prevent with the comprehensiveness and the speed that the privilege’s unrestricted capability provides. The Security Consulting function must advise on user privilege management with the urgency that this evidence demands, recognising that the investment in the robust privilege governance architecture prevents more consequential security incidents and limits more damage from the incidents that occur than almost any other comparable security investment.

The privilege management challenge is fundamentally a governance challenge rather than a purely technical one, because the technical access control systems can only implement the governance decisions whose quality the access management process creates. The IAM platform that provisions the access the business requests without the access assessment that the least privilege principle requires will create the over-privileged user population whose access the technical system accurately reflects and whose security risk the governance failure has created. The Security Consulting function must advise on the privilege management governance with the process rigor that the access governance quality demands alongside the technical control architecture whose enforcement the access governance decisions require.

Understanding Privilege Risk #

The privilege risk landscape that the Security Consulting function must communicate to the business and executive audiences whose governance decisions determine the privilege management investment reflects the specific adversarial and insider threat scenarios whose realisation the inadequate privilege governance enables with the consequences that the business impact assessment must quantify in the financial and operational terms that the investment case requires.