How should privileged accounts be secured in both Linux and Windows?

Question

I have recently started work in application security at a mid-sized firm, having transitioned away from 5+ years in security consulting (pentesting, etc). One of the biggest challenges I see here from the start are that security scanners and other tools use root/Administrator access, since that is what vendors had told them to use, most likely because of the ease of configuration. I really don't like this idea. For instance, Nexpose and Nessus are both configured to use root and Administrator.

My question - What are the best practices in terms of governing access to these privileged accounts? My initial thought is to have a type of password-vault system, that solely knows the passwords to the system. Then, a user can "check out" the root/Administrator password as needed" For Nessus in particular, only a few commands are run as root, so I think it would make sense just to create a standard user, and add it to the sudoers file while only allowing those specific commands.

Answer 1

For Linux, disable root if you don't need it. Use sudo with a properly configured sudoers file. This allows fine-grained control over what users have what superuser permissions (i.e. you can allow sudo only for Nessus). Alternatively, you can set permissions so the account running Nessus has permissions to access the resources it needs (this will be more involved, especially if it involves things like network devices)

For Windows, it's a little more complicated, but if you set up your ACLs correctly, you should be able to run Nessus as a (custom?) service account that has permissions to whatever resources you normally need admin for (so you won't be prompted for passwords).

The password vault idea is dangerous. If you trust your users enough to give them an admin password, they should be admins in the first place (I'm guessing this is not the case).