Critical Control 8: Controlled Use of Administrative Privileges
- Monday, February 8, 2010, 7:31
- Threat Research
Critical Control 8: Controlled Use of Administrative Privileges
The “golden ticket” for attackers is administrative or root privileges on a system. With these privileges attackers have complete control of the machine they are operating on, or even more. The most obvious scenario for an attacker to gain administrative or root access is to take control of an administrative or root account. But attackers may also trick users with administrative privileges to do unsafe things on the attacker’s behalf, or misuse systems, services or processes that are running with administrative or root privileges. Critical Control 8 focuses on ensuring that administrative privileges are used as little as possible.
Every operating system – be it on a PC, a server, a mobile phone, a router, a managed switch – requires some kind of system account that is all-powerful. In order for machines to do what we want them to do, there has to be some ability for us to control everything on that system. In Microsoft Windows operating systems, this all-powerful account is the “administrator” account. In the Unix and Linux world, it is known as the “root” account. Apple’s Macintosh and mobile operating systems also use “root.”
But the differences between the administrative accounts on operating systems is far more than just the accounts’ names. The “administrator” in a Windows environment and the “root” of the Unix/Linux variety also have different spheres of
Continue reading...