1

Let's say a user requires admin privileges as part of their role for installation of required tooling. Would allowing them a separate admin account to perform these activities be best practice as opposed to needing a separate team member with admin rights to do the installations for them?

Does allowing an individual with multiple accounts (one admin level and one standard), go against separation of duties? I think it doesn't go against separation of duties as any changes made would go through a change approval process requiring reviews and sign-off from other key stakeholders.

But it would be great to get your thoughts.

0

1 Answer 1

2

You created a bit of a paradox here that needs to be unpicked.

  • If you require that tool installation is a job duty that needs to be performed by another person, then facilitating that duty to be done by the end user (by giving an admin account) is a violation of SoD
  • If you require that the tool installation is a job duty that is inherent in that end user's job role, then it isn't a violation of SoD

Duties should be separated according to role need

You state that providing the admin account isn't a violation because there are change management processes to approve the legitimate installation of tools. That's a totally different issue. With a SoD lens, you have given the "duty" of installation to the end user. This means that the end user could also install illegitimate tools, which opens a separate risk that would be mitigated by giving this duty to another party.

So, the question is, should this "duty" (the installation) be separated into different parties? That's a decision for the business. "What constitutes a legitimate duty of this user?" And that's not something that can be captured in a "best practice" standard. That's a risk assessment balanced against business need. More separation means fewer ways for the end user to create a problem, but more separation also creates friction for the end user to do their other duties.

And in this case, giving the admin account to the end user is not a factor in determining "duties". That's another issue entirely.

Principle of Least Privilege

What I also think you are mixing into this situation is the "Principle of Least Privilege" (PoLP). People should only have as many rights (privileges) as are required by their duties (see above).

If the end user has the duty to install tools, then they need the rights to do that. Best practice states that those elevated rights to install software should be in a separate, non-everyday-user account to protect against account compromise. But even this can create friction in some environments (software dev). So, some balance needs to be struct there (unless you need to comply with some regulations that state a certain requirement).

Conclusion

So, the answer to your question is, "it depends on whether installing tools is a legitimate duty of the user" but if you do assign this duty to the user, best practice states that admin rights be assigned to a separate account.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .