Applying "principle of least privilege" when it comes to execs and owners of the company - should they automatically get all permissions if requested?

Question

As an administrator of certain systems in a company I understand and adhere to the "principle of least privilege" -- which I'm assuming I don't need to repeat its definition here, so let's just say people here get given access to systems only in accordance with what they need for their role and no more. I follow that principle and check carefully whether they can have read-only access in order to carry out the role and if so I give read access only, etc.

I had a request from an executive-level (C-suite) person ("Jack", let's say) who is actually one of the five co-owners of the company, to get blanket "sysadmin" level access to a particular system. (I am confident the request has come from Jack himself and isn't a hacking or phishing attempt, as I verified it with Jack directly.)

Jack is far too important and involved with strategic stuff to need to carry out any day-to-day work with this system, especially anything that would need sysadmin level access, but occasionally wants to get involved in "poking around" in there, as he is technical by background.

I get the sense that he doesn't like the idea that he is "walled off" from some system although he owns part of the company.

I'm not asking about the interpersonal aspects about this, just the info-sec ones.

Is it accepted info-sec practice to give an owner of the company "sysadmin" access and by doing bypass the "principle of least privilege"? -- since, after all, Jack (partly) owns the company so it's all his stuff anyway!

Or should that still apply, and even the CEO shouldn't have write-access to a system when they don't need it as part of their job function?

Answer 1

InfoSec Answer

Do not give his normal account elevated access. Create a new account. This limits the risks of cross-system access. And this follows the standard of admin accounts not being the normal user accounts.

IT Answer

Jack is now the owner of the system with all the rights and responsibilities that accompany that. Make sure that is clear. You can't have "the boss" make changes that override what the rest of the IT team are trying to do. Jack also needs to comply with your change management processes, etc. just as any system owner would.

Business Answer

Being the boss does not excuse anyone from the policies and procedures put in place to protect the business. This is true in IT, Finance, and every other business function. And you might need to have this uncomfortable discussion with him.

Answer 2

He's the boss, so you have to follow his instructions. Just make sure to tell him elevated privileges in a computing environment make it very easy to accidentally break the system if he makes any mistakes.

From an Information Security aspect it is of course a very bad request. Not only can he make mistakes, but he has to safeguard these login credentials much more than he is probably capable of doing. Does he even know what a secure password is or how to safeguard his credentials?

It's stupid. But owners can be that way.

Perhaps ask if he would be satisfied with "read only" privileges (no write access) to mitigate this risk.