We built the privileged access arrangement properly. A vault, credentials checked out against a stated reason, time-limited sessions, recording, and an approval for anything at the highest tier. It was a year of work and it was the right design.
Then I asked how often it was used. Four thousand one hundred check-outs in twelve months, by twelve people, with a median session length of most of a working day.
That is not an emergency control. That is how the team works, described flatteringly. When we sat down with the engineers and went through a fortnight of check-outs line by line, the reason was neither laziness nor bravado. Role-based permissions had been completed for the platforms that were easy and abandoned on two of the ones that mattered, so the only route to perform an ordinary daily task on those systems was to take the emergency credential. Everybody knew this. It had simply never been written down anywhere that a manager would read.
Underneath that sat the things the vault had never covered. The storage array, the hypervisor consoles and the building management system each had a single shared administrator login. An application whose supplier requires one named support account, shared among their staff. Four suppliers logging in through a single credential each, so that the person on the other end of any given session was somebody we could not name. When an auditor asked who had performed a specific action, the honest answer was a group of eleven.
The fix that worked was not tighter control of the emergency path. It was making the ordinary path sufficient, because the emergency path is only abused when the ordinary one is inadequate. We finished the role definitions we had abandoned, and check-outs fell by about eighty percent within a quarter. What remains is genuinely rare, reviewed weekly with a name against it, and it now raises a page, because if something is an emergency then somebody ought to be told it is happening.
Supplier staff have individual accounts in our directory or they do not get in. Two objected and both complied.
A control invoked four thousand times a year has stopped being a control. It has become a process, and nobody decided to make it one.
– Serguey Shinder
