Restrict Administrator Privileges to Dedicated Administrator Accounts
Description
Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.
Implementation Checklist
Tool Recommendations
Privileged access management platform for securing, managing, and auditing privileged credentials and sessions
CyberArk · Per-user subscription
Privileged access management with endpoint privilege management, secure remote access, and password vaulting
BeyondTrust · Per-user subscription
Privileged access management with password vaulting, session recording, and just-in-time privilege elevation
Delinea · Per-user subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Phishing-Compromised Admin Account Full Domain Takeover
ConfidentialityAn administrator using their privileged account for daily email and web browsing is phished, and the compromised credentials grant the attacker immediate domain admin access.
Drive-By Download Executing with Admin Privileges
IntegrityA user browsing the web with an account that has administrative privileges encounters a drive-by download exploit that executes malware with full admin rights on the system.
Credential Theft via Admin Account Browser Session
ConfidentialityAttackers steal browser-cached credentials from a session running under an administrative account, obtaining tokens or saved passwords that grant elevated access across the enterprise.
Vulnerabilities (When Safeguard Absent)
Administrative Privileges Used for Daily Activities
Administrators using their privileged accounts for email, browsing, and general work expose their elevated credentials to phishing, malware, and credential theft attacks.
No Separation Between Admin and Standard User Accounts
Without dedicated admin accounts separate from daily-use accounts, compromise of any admin user's session immediately grants the attacker full administrative access.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Technical | Email security configuration (SPF, DKIM, DMARC records) | Verified quarterly |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |