asecurityguru.comarticleUser Accounts and Privilege Management
Introductory primer on OS user accounts and privilege management. It covers permissions versus privileges, the Principle of Least Privilege, vertical versus horizontal privilege escalation, UAC and sudo, and group-based access. It then moves to enterprise controls: IAM, RBAC, PAM with credential vaulting and session monitoring, Just-In-Time access, Endpoint Privilege Management and Zero Trust. It includes a best-practices list, an FAQ on service-account targeting and why MFA does not replace PAM/JIT, and a tip to start with Azure PIM and forward logs to Splunk for privilege-event alerting.
TL;DR Beginner-level primer on least privilege, privilege escalation, and IAM/RBAC/PAM/JIT/EPM as the building blocks of Zero Trust.
Organisations named here
- CISA Zero Trust Maturity Model
- NIST SP 800-53
- Zero Trust
Technologies named here
- macOS
- Service accounts in cloud and on-premise environments
- Local administrator rights on endpoint workstations
- Multi-Factor Authentication - verifies identity at login
- NIST SP 800-53
- microsoft
- CISA
- Windows
- Linux
- Azure
- Splunk
Techniques named here
- Exploiting local administrator rights on workstations
- Targeting service accounts
- Group-based access control
- Principle of Least Privilege
Related in Learning
hausec.comwriteupCreating a Red & Blue Team Homelab
bencteux.frarticleELearnSecurity Certified Threat Hunting Professional (eCTHPv2) review
protocolsoup.comtoolProtocol Soup
0xv1n.github.iowriteup