REPORTThe Broken Promiseof Least Privilege

How unused access, permissions, andresources are increasing your attack surface

Least Privilege: A Failed Promise
The Principle of Least Privilege. It’s the idea that every person or thing in yourenvironment should only be granted the baseline access and permissions required
to do their jobs. 

Logically, that makes sense. Why would you provide permissions or accessbeyond what an individual needs? Especially when the outcome can becatastrophic. In fact, 61% of all breaches involve using credentials to gain accessto sensitive systems—so of course you’d want to limit the access to thosesystems. 

Furthermore, an analysis of real-world access management and permission usage
across 225 companies, ranging from small startups to large enterprises shows
85% of credentials with privileges have not been used in the last 90 day
Nearly 1 in 3 users with access to systems have not used that access in the last
90 days
15% of resources available have not been accessed in the last 90 days.

The problem? The ability to audit, track, and understand how permissions arebeing used (or if they’re used at all) has been non-existent. Until now. The findings
are clear: organizations need visibility into privileged access and its usage to fully
understand and address their total attack surface.

02Breaking Down Access: Users, Resources, & Privileges

Users
Identities that have access to aparticular system.

Resources

Privileges

Infrastructure accessed by users.

Identities with standing elevatedpermissions to specific resources.

This report breaks down access across three dimensions: users, resources, and privileges.
Each is defined below, and helps to paint the broader picture—that the gaps in visibility into
permission usage creates a significant attack surface for virtually every organization.

03

Unused Privileges, Unnecessary Risk
Privileges are a critical source of risk for every organization. Every user or identitythat has elevated privileges can be a target for credential theft, credential
stuffing, or ransomware, among others. It’s no wonder that credentials are
involved in nearly two-thirds of all breaches. 

Even worse, the analysis shows that 85% of credentials with privileges have notbeen used in the last 90 days. These are privileges that are available, unused, andripe for the picking for bad actors. And this raises an obvious question: if theprivileges have not been used in the last 90 days, are they even needed?
Deprovisioning unused credentials with privileges is a substantial opportunity forsecurity teams to reduce their overall attack surface. 

The principle of least privilege requires that credentials have the bare minimum
privileges possible to be productive—and yet 85% of privileges go unused. Not
having visibility into privileges use across the entire stack has prevented security
teams from taking remedial actions, and enabling them to truly take a leastprivilege approach. It’s virtually impossible for security teams and admins to know
which permissions are actually needed, and this type of visibility provides adata-driven approach to managing permissions based on real-world usage.

Existing Privileges Used in the Last 90 Days

Privileges Available

Privileges Used02,000,000

4,000,000

6,000,000

85% of privileges have not been used in the last 90 days

04

The Impact of Over Provisioning
It’s not just privileges that go unused. In many cases, the complexity ofprovisioning access on an identity-based level results in users being
over-provisioned, and having access they may not need. 

In fact, the analysis shows that nearly 1 in 3 users have access to systems thatthey have not used in the last 90 days. The heterogeneous nature of modern
technology stacks has made it extremely difficult for security teams to track
which credentials are being used, what systems are being accessed, and bywhom. This lack of visibility has resulted in access to systems living in perpetuity,
but not being used, and creating unnecessary risk. 

Access Used in the Last 90 Days

Users with Access
Users Who Used 
AccessUsers having unnecessary access is the antithesis of least privilege, and presents
a tangible opportunity for security teams to audit access usage across teams,
and deprovision access that exists, but is not being used.
 

029%

5,000

10,00015,00020,000of users have not used their access in the last 90 days and could
be an attack target

05

The Risk & Costs of Unused Resources
Getting visibility into access and usage extends beyond reducing risk. In this case,the analysis has shown that 15% of resources available have not been accessedin the last 90 days. 

Resources includes everything in your stack—databases, servers, cloudresources. These unused resources are not just a security risk, they may also besystems that can be deprovisioned or moved to a cheaper service to free up
budget for other uses. Similar to unused privileges, the question at hand is, “Ifthese resources haven’t been touched in 90 days, do we still need them?”

In the case of the principle of least privilege, it’s not only credentials to beconcerned about, it’s the systems that can be accessed by those credentials.
Getting visibility into system usage gives security teams an opportunity toreduce their overall risk, while also reducing costs by identifying unusedresources.

Resources Available in the Last 90 Days

Total Resources

Resources Accessed0

20,00040,00060.00080,00015% of resources have not been accessed in the last 90 days

06

The Impact of Visibility on Least Privilege
The principle of least privilege is not a flawed methodology. It’s just amethodology that has been impossible to embrace due to the inherentchallenges by modern technology. 

The challenge of getting visibility into access, privilege, and resource
usage across your entire tech stack is daunting. But the benefits ofdoing so can be immense
Lower risk by removing unnecessary privilege
Reduced attack surface by right-sizing user acces
Cost savings and reduced attack surface by deprecating unused
resources

Your ultimate goal when implementing least privilege should be toeffectively get to zero: zero unused privileges, zero over provisioning,and zero unused resources. 

ZEROYou should also aspire to have zero credentials exposed either to theend user or end-user system. This ensures that even where credentials
may be over provisioned or have unnecessary access, the humanelement of risk is removed.

07Getting to Least Privilege: StrongDM When it comes to access management, leastprivilege is a critical stepping stone on your journey
towards achieving zero standing privileges anddynamic access. But historically, it’s been extremely
difficult to get the visibility you need in order toimplement least privilege as it was meant to berealized.  

That’s where StrongDM comes in. StrongDMprovides the visibility you need to not only
implement least privilege, but also enable you toprogress on the Secure Access Maturity Model, amodel designed to help you go from identity-based
access to dynamic access management. 

These changes don’t happen overnight. Achievingtrue dynamic access is a journey, and being able toreduce risk, limit access to sensitive systems, andunderstand systems not being used, is an importantmilestone. StrongDM can help you get there.

Secure Access Maturity Model

Level 4

Dynamic Access
Level 3Just-in-Time Access

JIT accountcreation/remova
Always-on/sharedaccounts eliminate

Limited-scope admin
account JI

Audit and compliancerequirements supported

One-off &project-period access

Access extends into fulltech stack

Personal-privilege
accounts under PA

Personal-privilege
accounts under PA

Limited-scope admin
account JI

Multipurpose accounts
under PAM

Multipurpose accounts
under PAOne-off &project-period acces

IdP adopte

IdP adopte

IdP adopte

IdP adopte

SSO adopte

SSO adopte

SSO adopte

SSO adopte

MFA in us

MFA in us

MFA in us

MFA in us

Always-oAlways-oAlways-oAlways-oShared accounts

Shared accounts

Shared accounts

Shared accounts

Level 2

Privileged Access
Level 1

Identity-Based Access

Level of Maturity

08

Methodology
This ebook was produced by StrongDM. It is an analysis of the real-world accesspatterns of 225 companies, ranging from small and medium organizations to large
enterprises.

09

StrongDM is a Dynamic Access Management platform that puts people first by giving
technical staff a direct route to the critical infrastructure they need to be their mostproductive. End users enjoy fast, intuitive, and auditable access to the resources they need.
Administrators gain precise controls, eliminating unauthorized and excessive accesspermissions. IT, Security, DevOps, and Compliance teams can easily answer who did what,
where, and when with comprehensive audit logs. It seamlessly and securely integrates withevery environment and protocol your team needs, with responsive 24/7 support.