14th October 2021 - Bianca Ysabel

The term “privilege creep” refers to the gradual accumulation of access rights beyond what a person needs in order to perform his or her job.

It used to be relatively straightforward to trace system users and know what access rights they have been granted in relation to system resources.

Nowadays, with the wide range of networks that extend to geographically diverse locations, supervising the people who have privileged access to specific apps and systems at any given time is becoming more challenging.

As a result, there are users who end up having access to numerous systems which they should not really have. This results in unseen areas and weak spots that are ripe for the intrusion of an unauthorised data breach.

How can “privilege creep” become dangerous?

Over time, privilege creep can pose a serious threat to the security of any business organisation that is trying to safeguard an extended or diverse enterprise network. The threat lies in the movement of employees within a business. As these employees get promoted or receive new responsibilities, they are given access to more systems and at the same time still have access to the old systems.

Before you know it, a substantial number of employees can have access to systems that are no longer relevant to their present position where is stored a large amount of sensitive enterprise or customer data that includes specific personal information or sensitive confidential data. This results in both insider and outsider threats to the security of system resources.

There are also some employees who try to elevate their access rights by using a privileged user’s log-in details to access systems they are not authorised to access. While most employees do this for honest reasons, for example, to complete a task quickly, this increases the risk of security breaches and there are also those few individuals who may engage in this behavior for malicious intentions.

The majority of security breaches are caused by default, compromised, lost, or stolen privileged credentials.
Organisations that fail to monitor and manage privilege creep may fall victim to disgruntled former employees and find themselves in the limelight because of a major security breach or a news headline.

Outside threat know how to take advantage of privilege creep

Cybercriminals and external threat actors are well versed in capitalising on privilege creep. They are very proficient in finding ways to gain access to confidential systems and exploit vulnerable employees. Some of their tactics include the use of phishing expeditions, social engineering techniques, and password sniffers to obtain an employee’s login information.

The legitimate credentials are then used to bypass security defenses to elevate privilege access into the deeper network. Once inside, they can then steal sensitive information and /or set off a cyberattack that can wreak havoc in the system.

Least privilege can mitigate the threat

Business owners and managers need to assume that every employee can be exploited by threat actors, or even become one. Employees must be given the minimum level of access to perform their tasks at any given time. Once the task is completed, the access can be removed to avoid creating weaknesses or “security blackholes” in system networks.

Businesses should also consider the partition of duties, especially for those that handle sensitive information and processes. For this, identity access zones are used to limit an employee’s rights to the resources that they need on a day-to-day basis that is based on their specific roles.

Lastly, businesses need to choose a straightforward solution in managing and elevating employee access on a “just enough” and “as needed” basis coupled with strong administrative controls at every level. Processes can be implemented so that the employees need to go through multi-level approvals. In this way, the process shows exactly who approved access and other details related to the particular request to gain access to system networks and proprietary data.

Takeaway Points:

• At present, with the wide range of networks extending to geographically diverse locations, supervising people who need to have privileged access to specific apps and systems at any given time is becoming more difficult.
• Over time, “privilege creep” can pose a serious threat to the security of any business organisation that is trying to safeguard an extended or diverse enterprise network.
• The threat lies in the context of upwardly mobile employees within a business.
• Most security breaches are caused by default, compromised, lost, or stolen privileged credentials.
• Adopting role-based access and the principle of least access will help businesses greatly in the proper safeguarding and protection of their most sensitive data.

Our Trademark Lawyers in Sydney are Experts when it comes to Registering Trademark or Trademark Opposition Process in Sydney

Bianca “Bianx” Ysabel, Digital Administrator

Contact W3IP Law on 1300 776 614 or 0451 951 528 for more information about any of our services or get in touch at law@w3iplaw.com.

Disclaimer. The material in this post represents general information only and should not be taken to be legal advice.