For many years it was normal for Windows users to be local administrators on
their machines the need for local administrator was influenced by the fact
that the Microsoft ecosystem needed administrator rights in order to install
and run software for those of you who remember when Windows 7 first came out
and the UAC user account control it was a controversial setting it was actually
put in place as a long-term program to get developers to not demand
administrator rights and to remind us users and all honestly buyers of
software to demand that our developers do a better job as the years have gone
by we've gotten more used to running without administrator rights but every
now and then I still see applications that demand this now Twitter is
sometimes controversial itself but also I find it a very good place for
conversations about security and the other day I found it tweet by Sean Matt
Metcalf and he talked about the topic of why users should not have local
administrator rights to the workstation and here's some of the reasons that he
gave number one it makes it easier for an attacker to gain a foothold on the
system if they have administrator rights they can compromise the ls aass account
local service managed management automation for more credentials number
two it makes logging more complicated and makes for chattier event logs if all
users don't have local administrator rights you can look for event 4672 if
users are administrators monitoring for this activity makes it practically
useless number three when the user has local administrator rights ransomware
has all the access it needs to totally brick a system and possibly go farther
inside your network and last but certainly not least if you've set up
your network where the local administrator password is the same
throughout your entire organization all it takes is the attacker to pop that
credential they can do lateral movement throughout
the entire network if you haven't downloaded already I highly recommend
that you download the local administrator password solution or lapse
toolkit this allows you to set up a system where randomly generated
passwords are set up as that local administrator password it's centrally
managed so you can still gain access should you need to deploy software
install things you name it but it doesn't have the same local
administrator password throughout the network if you still run your network
that way it's very dangerous attackers are looking for that weakness and they
will go after you and nail you now if you thought the user account control in
Windows 7 and Windows 10 is protection device think again again it was only set
up to force our developers to move away from using local administrator rights
there's actually attack sequences that will use weaknesses in UAC there's on
github UAC meat it defeats user account control
by abusing the built-in Windows auto elevate backdoor and recently an
attacker disclosed that there's almost 300 Windows 10 executables vulnerable to
DLL hijacking one simple VBS script may be enough to allow users to gain
administrative privileges and bypass UAC so now that we know local administrator
on the desktop is not a good thing what else do we need to protect in our
environment on the cloud side what about the global administrator the keys to the
kingdom as I call it back to Sean Metcalfe back in 2019 he talked about
that he was investigating office 365 in his or ID and found a weakness in there
if the global administrator can has compromised an attacker can toggle role
called access management for xuer resources if this axis is toggled in the
admin console it adds the account to the user access administrator role in as
your rbac at the root scope
bottom line allows the attacker to get into way into yours or access and cause
real issues inside your network so how can you protect yourself from this well
there's two ways way number one is of course and I'm going to say this over
and over again until you guys all do it is ensure you have multi-factor
authentication on your global administrator accounts in particular and
all user accounts on all roles that are in office 365 so everyone from A to Z
and your organization should have multi pack roth authentication on every office
365 account next you'll want something called privileged Identity Management or
PIM now it does need additional licensing you'll need an azure 80
premium - or an e5 but you don't have to have this one throughout your entire
organization so on your global admin accounts need this license so a p2 or an
e5 for your global admins and you want to turn on what's called the PIM what
PIM does is set up a process where activities are approved and logs so you
can actually track them better so for example you could configure a privileged
access management policy that requires explicit approval to access and change
organization mailbox settings in your tenant so it's key that you look to see
to enable this and also turn on auditing and again I cannot stress this enough
for office 365 users and every single global administrator you want to make
sure that you have multi-factor authentication remember that you can
either use the Microsoft Authenticator app Google's Authenticator app you can
also use key fobs I personally find that the Microsoft Authenticator app on my
iPhone is the easiest way most everyone has an iPhone or smartphone in their
pocket if someone doesn't have a smart phone there are other ways you can
implement multi-factor including a phone call back a text message
and remember that you've probably heard in the news where multi-factor
authentication based on text messages may not be secure but anything that
takes you out of the low-hanging fruit range is better than nothing at all so
yes there have been attacks against text messages but usually they're targeted
and they're high targets and I'm guessing since most of you were not
Department of Defense or other high military targets you can probably get
away with just the normal at the Authenticator out so remember is all MFA
foolproof absolutely not but doing any form of multi-factor takes you out of
the reach of most attackers your goal is to not be 100% secure your goal is to be
just a little more secure than the guy down the street so that the attackers go
down after the guy down the street so take the time to look at privileged
Identity Management or PIM audit your network and make sure you don't have any
local administrators and if you do make sure that you set up the local
administrator password toolkit or lapse and last but certainly not least check
us out on the IDG Tech Talk YouTube channel and until next time this is
Susan Bradley for CSO online stay safe stay well and stay a little bit more
secure than your next-door neighbor
you