Privileged Attack Vectors: Building Effective Cyber-Defense Strategies to Protect Organizations

© Morey J. Haber and Brad Hibbert 2018

Morey J. Haber and Brad HibbertPrivileged Attack Vectorshttps://doi.org/10.1007/978-1-4842-3048-0_9

9. Privileged Monitoring

Morey J. Haber¹  and Brad Hibbert²

(1)

Heathrow, Florida, USA

(2)

Carp, Ontario, Canada

 

The primary risk for any privileged access activity is the activity itself. As an administrator or root, you must ask the following question: Was the activity appropriate, a mistake, or a threat actor behaving badly using elevated credentials? Unless you are sitting over someone’s shoulder and have the expertise to monitor the activity, there are plenty of gaps in the traditional security model to review this activity and verify every session, every command, and all the information downloaded or displayed ...