Privilege Management

Admin rights let attackers install software, disable security tools, and move across systems. Removing them limits what a compromise can do.

1. 1Remove local admin from everyday accounts
2. 2Define rules for apps that may elevate
3. 3Route other requests through approval
4. 4Log every elevation

A user needs to install a printer driver. Instead of being a permanent admin, they request elevation for that installer only, and it is logged.

• “Removing admin rights will flood the help desk.” Good rules and self-service elevation reduce this.

Endpoint privilege management (EPM) covers devices; privileged access management (PAM) typically covers admin accounts on servers and infrastructure.

1. How does elevation work offline?
2. Is application control included?

• CIS Critical Security Controls
• NIST Cybersecurity Framework 2.0