A Hacker’s Dream: Unmanaged Privileges

Chris Hills, deputy CTO at BeyondTrust and a former privileged-access lead at a large brokerage, looks at what the rush to remote work did to privilege hygiene. After describing COVID-themed phishing and smishing, he frames secure remote access as three decisions: how people connect (never RDP or SSH exposed to the internet, and no VPN clients on unmanaged home computers), what they reach (on-prem, cloud or both, and the bandwidth cost of routing everything back), and how the help desk supports them. He then lists the risks: remote access as the top attack vector, unmanaged credentials including service, application and network-device accounts, shadow IT from staff downloading free remote tools, and the difficulty of proving compliance when data is downloaded to a home file system. Using the Lockheed Martin kill chain, he argues the pandemic created a third threat category, the trusted person who is now external. His recommendations are granular access, least privilege, honouring change control, session and keystroke recording for sensitive accounts, VPN logs aggregated into a SIEM, MFA on privileged access, password injection and rotation, and someone actually reviewing the logs. The final third presents BeyondTrust's three PAM pillars.