{"id":9774,"date":"2024-06-21T05:50:21","date_gmt":"2024-06-21T12:50:21","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=9774"},"modified":"2024-06-20T08:26:30","modified_gmt":"2024-06-20T15:26:30","slug":"improving-security-by-protecting-elevated-privilege-accounts-at-microsoft","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/improving-security-by-protecting-elevated-privilege-accounts-at-microsoft\/","title":{"rendered":"Improving security by protecting elevated-privilege accounts at Microsoft"},"content":{"rendered":"

\"Microsoft[Editor\u2019s note: This content was written to highlight a particular event or moment in time. Although that moment has passed, we\u2019re republishing it here so you can see what our thinking and experience was like at the time.] <\/em><\/p>\n

An ever-evolving digital landscape is forcing organizations to adapt and expand to stay ahead of innovative and complex security risks. Increasingly sophisticated and targeted threats, including phishing campaigns and malware attacks, attempt to harvest credentials or exploit hardware vulnerabilities that allow movement to other parts of the network, where they can do more damage or gain access to unprotected information.<\/p>\n

We on the Microsoft Digital Employee Experience (MDEE) team, like many IT organizations, used to employ a traditional IT approach to securing the enterprise. We now know that effective security calls for a defense-in-depth approach that requires us to look at the whole environment\u2014and everyone that accesses it\u2014to implement policies and standards that better address risks.<\/p>\n

To dramatically limit our attack surface and protect our assets, we developed and implemented our own defense-in-depth approach. This includes new company standards, telemetry, monitoring, tools, and processes to protect administrators and other elevated-privilege accounts.<\/p>\n

In an environment where there are too many administrators, or elevated-privilege accounts, there is an increased risk of compromise. When elevated access is persistent or elevated-privilege accounts use the same credentials to access multiple resources, a compromised account can become a major breach.<\/p>\n

This blog post highlights the steps we are taking at Microsoft to protect our environment and administrators, including new programs, tools, and considerations, and the challenges we faced. We will provide some details about the new \u201cProtect the Administrators\u201d program that is positively impacting the Microsoft ecosystem. This program takes security to the next level across the entire enterprise, ultimately changing our digital-landscape security approach.<\/p>\n

[Learn how we\u2019re protecting high-risk environments with secure admin workstations<\/a><\/em>. Read about implementing a Zero Trust security model at Microsoft.<\/a><\/i> Learn more about how we manage Privileged Access Workstations<\/a><\/em>.]<\/em><\/p>\n

Understanding defense-in-depth protection<\/h2>\n

Securing all environments within your organization is a great first step in protecting your company. But there\u2019s no silver-bullet solution that will magically counter all threats. At Microsoft, information protection rests on a defense-in-depth approach built on device health, identity management, and data and telemetry\u2014a concept illustrated by the three-legged security stool, in the graphic below. Getting security right is a balancing act. For a security solution to be effective, it must address all three aspects of risk mitigation on a base of risk management and assurance\u2014or the stool topples over and information protection is at risk.<\/p>\n

\"Information
The three-legged-stool approach to information protection.<\/figcaption><\/figure>\n

Risk-based approach<\/h3>\n

Though we would like to be able to fix everything at once, that simply isn\u2019t feasible. We created a risk-based approach to help us prioritize every major initiative. We used a holistic strategy that evaluated all environments, administrative roles, and access points to help us define our most critical roles and resources within the Microsoft ecosystem. Once defined, we could identify the key initiatives that would help protect the areas that represent the highest levels of risk.<\/p>\n

As illustrated in the graphic below, the access-level roles that pose a higher risk should have fewer accounts\u2014helping reduce the impact to the organization and control entry.<\/p>\n

The next sections focus primarily on protecting elevated user accounts and the \u201cProtect the Administrators\u201d program. We\u2019ll also discuss key security initiatives that are relevant to other engineering organizations across Microsoft.<\/p>\n

\"Illustration
The risk-role pyramid.<\/figcaption><\/figure>\n

Implementing the Protect the Administrators program<\/h2>\n

After doing a deeper analysis of our environments, roles, and access points, we developed a multifaceted approach to protecting our administrators and other elevated-privilege accounts. Key solutions include:<\/p>\n