Removing Endpoint Admin Rights from Technical Users: Stopping the Attack While Enabling the User
OnlineIt's common knowledge that removing local admin rights is one of the most straightforward ways to protect an organization from cyberthreats. Without elevated privileges, threat actors can’t easily (if at all) identify admin accounts that can be used to move laterally and further an attack. In essence, without local admin rights, the endpoint is the end of the line for an attacker. It’s easy to remove local admin rights for end users that are in Marketing or Sales. But once you start trying to remove rights from technical users like development or QA that require more rights than just a local user, it becomes extremely difficult. It’s one of the reasons threat actors target these kinds of users in spear phishing attacks and job-themed social engineering attacks – the assumption is that the victim already has admin rights on the endpoint. So, how can you remove local admin from even the most technical user and still keep them working? In this Real Training for Free session, 4-time Microsoft MVP, Nick Cavalancia takes my seat and first will cover: Why local admin rights are a critical point in a cyberattack What MITRE ATT&CK TTPs rely on having local admin rights Up […]
