YOU DIDNT SAY THE MAGIC WORD UPGRADE
YOU DIDNT SAY THE MAGIC WORD FULL
YOU DIDNT SAY THE MAGIC WORD SOFTWARE
YOU DIDNT SAY THE MAGIC WORD DOWNLOAD

In this attack vector the compromised account, apps, programs, and services are not the primary attack targets but rather the permissions used to run those apps, programs, and services are targeted in order to gain administrator access.

YOU DIDNT SAY THE MAGIC WORD FULL

If a user has permissions to run certain apps, programs, or services as an administrator, the attackers can take advantage of those privileges and essentially piggyback off of them in order to run their malicious scripts and either gain full access as administrator or create their own administrator account on the device. The principle of least privilege can apply here as well.

YOU DIDNT SAY THE MAGIC WORD SOFTWARE

This usually involves some sort of exploit in a piece of software or the computer itself that is used to gain this elevated access.

YOU DIDNT SAY THE MAGIC WORD UPGRADE

Privilege Escalation is the step attackers take after they have gotten an initial compromise of a device, account, or software and look to upgrade their privilege from whatever normal user privileges they have gained to full administrative privileges that they can then abuse. Believe it or not, I have seen firsthand both of these scenarios in multiple schools districts over the years and unfortunately, some of them have paid the price in the form of malware and a compromised network.Īnother way that attackers abuse unneeded permissions is through privilege escalation.

YOU DIDNT SAY THE MAGIC WORD DOWNLOAD

This is often an older policy that was put in place to save time for the technology department so they wouldn’t have to deal with staff asking permission to download software on their devices or even worse a higher level of authority, like district administration, required the technology department to implement local administrator privileges to all staff as an easy way to stop complaints from other staff that wanted to download a piece of software but didn’t have permission to do so. One of the most common and most severe violations of the principle of least privilege that school districts often fall prey to is having all staff have local administrator privileges regardless of whether or not they are needed. So for example you may have a security group for school administrators and security for teachers that is nested within a security group for one specific school building in the district. Nesting groups within groups is also a great way to fine-tune security permissions. User rights are assigned to a security group to determine what members of that group can do within the scope of a domain or forest while security group permissions are assigned to the security group for the shared resource.

Security groups allow us to assign permissions through user rights and group permissions. This can be accomplished in a variety of ways with the most popular being managing permissions through Active Directory Security Groups. In practice, the principle of least privilege looks like teachers should only have the privileges they need to do their job, district staff only have the privileges they need to do their job, technology teams only have the privileges that they need to do their job, and so on throughout the district. Sure, Dennis Nedry was a key piece of building Jurassic Park, but did he need access to the entire park’s power system? If he didn’t have access to the entire power system would he have gone through with the plan that ultimately ended Jurassic Park before it even began? While we may never know the answers to these questions, we can take the hard lesson that Jurassic Park learned and apply it to our school environment to create a more robust security posture, without, of course, the more than likely overpriced meal plan and the highly intelligent velociraptors chasing us around every corner. In the case of Jurassic Park, this whole situation could have been avoided if they had applied the principle of least privilege throughout the systems in the park.

The Principle of Least Privilege is the principle that users and programs should only have the necessary privileges to complete their tasks. Understanding the Principle of Least Privilege

You didnt say the magic word