How Granting Local Admin Privileges Could Cost You Your Business
Key Points in This Article
- Historically, many overburdened IT departments have sought to save time and work by granting multiple users across their business or organization local administrative privileges.
- Doing so substantially increases the risk that their network security may be compromised.
- The costs of a data breach are far higher than the productivity savings that may be achieved by granting such privileges.
These days, organizational cybersecurity should be top-of-mind for any cybersecurity professional. Whether cybersecurity is in your title or youโre a generalist handling everything from network maintenance to changing printer ink cartridges, itโs always critical that you keep an eye out for how our organizationโs operations may inadvertently be creating vulnerabilities third parties can exploit.
When cybersecurity professionals conduct risk assessments, they often find vulnerabilities stemming from organizational practices that are pretty common across industries. One such practice is granting local administrative rights to individual users, most often in small businesses, organizations, and those with understaffed IT departments.
The Dangers of Granting Local Admin Privileges
If youโve worked for an understaffed IT department, youโve likely spent much of your day handling mundane helpdesk requests. None of them take that much time, but there are a lot of them, and they donโt stop. You cannot devote adequate โ sometimes any โ time to the IT aspects of the organizationโs revenue-diving activities or essential network maintenance and security because there are so many requests.
In this scenario, perhaps you, like many IT administrators, realized many of these requests could be handled by individual users simply by giving them administrative privileges. You may have saved some time on routine tasks, like adding applications, users, and hardware. And you may have found yourself breathing a sigh of relief given that youโve now reduced the number of requests across your desk.
But doing so is a mistake. When you provide local admin rights to users across your organization, youโve inadvertently made it more vulnerable to intrusion. And the extra work youโll perform to address a data breach compared to the few minutes you may save installing a printer here, or there is certainly not worth it.
Users frequently try to install software programs they find online. When they do and lack local admin privileges, theyโre prompted to ask permission to download the software in question. This prompt allows IT administrators to vet the software and ensure it does not present a threat. But when users have local admin privileges, they have the freedom to download applications as they see fit. And they may even disable network security measures that vet new applications for the presence of malware and viruses to expedite installation.
In doing so, theyโve exposed your organizationโs network to risk. Malware and viruses lurk in seemingly harmless downloads found on official-looking websites. Not only can they compromise your userโs account and device. If downloaded on an account with local admin privileges, they can compromise your entire networkโs security. Malware on such an account could disable your organizationโs antivirus protections, turn off your firewall, and hijack your data on multiple devices.
Local admin privileges allow users to override the Group Policy youโve established. If a hacker gains control of an account with these privileges, they could prevent your Group Policy from being accessed or create their own. In either case, your security protocols would be compromised, giving a criminal the ability to access and steal your data, encrypt your system and hold it for ransom, and conduct other activities that could be financially catastrophic for your company.
Many cybercriminals specifically seek administrative credentials to penetrate corporate networks. Fundamentally, the smaller the number of accounts with administrative credentials, the less risk one of these accounts will be compromised. In practice, users who have been granted these credentials outside of the IT department, by and large, have had minimal, if any, cybersecurity awareness training or have not followed best practices to safeguard their accounts. Accordingly, cybercriminals have found their way into these accounts easily and have been able to cause considerable damage.
Why Local Admin Privileges Must Be Restricted
Even if your IT department remains small and understaffed, granting users across your organization local admin privileges is no longer justifiable. Any time you save will be more than offset by the damage that can be caused in the event of a breach.
As an IT professional, you will face countless hours over the following days, weeks, and months scrambling to address the threat, regain control of compromised systems, and ensure your employer can remain operational. Your business might face reputational damage and legal consequences if client data is compromised. And depending on your industry, you may face regulatory action if the breach occurred because you failed to meet legally mandated cybersecurity standards.
The cumulative financial consequences of a breach can be catastrophic. Some research asserts that as many as 75 percent of small and medium-sized businesses go under after a ransomware attack. And no industry or sector of the economy is safe. In May 2022, Lincoln University permanently closed its doors after a devastating ransomware attack.
Even if you donโt suffer a breach in the near term, granting users local admin privileges can create more work and headaches for IT. You may find that departments are now downloading and using software applications youโre not equipped to support. Or you may find that in attempting to manage relatively simple tasks themselves, theyโve inadvertently created more complicated problems for themselves โ and other users. You may not be saving yourself nearly as much time as you think.
Itโs also not uncommon for senior leaders to believe that they should be granted local admin privileges by virtue of their position. And when they have them, they may accidentally cause problems for themselves or other users that you must address. Or you may find them using their privileges to undermine organizational cybersecurity measures out of a misguided attempt to increase productivity or out of hubris.
The cybersecurity of your organization must supersede all of these considerations. To preserve it, you must tightly restrict administrative privileges across your organization and actively monitor the accounts that possess them. Moreover, you must educate all users about cybersecurity continuously and thoroughly. Doing so will help you keep your organization safe and help them understand their loss of these privileges is not about a lack of trust. In fact, when your co-workers make the connection between the proliferation of accounts with local admin privileges, data breaches, and their own jobs, theyโre likely to accept the removal of these privileges without protest.
Safe Network Solutions is a technology consulting firm located in Nashville, TN. We are focused on reducing our Clientsโ stress and the time they spend handling IT related issues. As technology has become more integrated with daily business tasks, downtime is not an option. Whether your systems reside on-premise, in the cloud, or in a hybrid setup, you need a partner with expertise in a wide array of technologies, with a security focus.
