Glossary
Privileged access
Privileged access is access that lets an account do things ordinary accounts cannot, such as change other people's access.
What the standards say
NIST’s glossary defines a privileged user as a user authorized, and therefore trusted, to perform security-relevant functions that ordinary users are not authorized to perform. A privileged account is a system account with the authorizations of a privileged user. NIST SP 800-53 Rev. 5, control AC-6(5), says to restrict privileged accounts to specific personnel or roles.
Why it matters in an access review
Privileged access is where a mistake costs most. The holder can often read everything, change settings, and grant access to others. Many teams review it more often than the rest. That is a choice. Check what your framework says before you rely on it. The guide to a privileged user access review shows how to run one, step by step.
Where it hides
It is not always called “admin”. In Keycloak it is the realm-admin role of the realm-management client, which contains the other management roles, and the admin role in the master realm. In GitHub it is the owner role of an organization. In AWS it is a broad policy, such as one that allows every action. It can also arrive through a group, a nested bundle of roles, a service account or an API token. The impersonation role of the same client lets its holder sign in as another user of the realm, with that user’s access. A list of named administrators will miss most of these.
An example
Suppose a check of who holds realm-admin in a Keycloak realm, with the routes, finds three names. One is a person. One is a deploy key. The third is a person who holds it only because a group she joined for another reason contains it. The guide on how to run a user access review in Keycloak shows how to run that check.
Common mistakes
- Counting only the people who are called administrators.
- Forgetting service accounts and tokens.
- Allowing shared admin logins, so the review cannot say who used them.
- Reviewing privileged access with the same reviewer and at the same speed as ordinary access.