From the Field: Least Privilege

🔎 𝗙𝗿𝗼𝗺 𝘁𝗵𝗲 𝗙𝗶𝗲𝗹𝗱 — Real-World Findings from Security Assessments

💥 𝟳𝟭.𝟰% of infrastructures I’ve assessed 𝗱𝗼𝗻’𝘁 𝗳𝗼𝗹𝗹𝗼𝘄 𝘁𝗵𝗲 𝗹𝗲𝗮𝘀𝘁 𝗽𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲 𝗺𝗼𝗱𝗲𝗹.

General problem – but this is where it starts.

💻 Users with 𝗹𝗼𝗰𝗮𝗹 𝗮𝗱𝗺𝗶𝗻 𝗿𝗶𝗴𝗵𝘁𝘀 on endpoints

🔐 Overprivileged service accounts thrown into 𝗗𝗼𝗺𝗮𝗶𝗻 𝗔𝗱𝗺𝗶𝗻𝘀

🚫 “𝗜𝘁 𝗷𝘂𝘀𝘁 𝘄𝗼𝗿𝗸𝘀” instead of “what’s actually needed?”

This mindset 𝗱𝗲𝘀𝘁𝗿𝗼𝘆𝘀 𝘆𝗼𝘂𝗿 𝗮𝗯𝗶𝗹𝗶𝘁𝘆 to enforce real security.

🛠 Use proper service accounts (MSA, gMSA, DMSA, VSA) — and give them 𝗼𝗻𝗹𝘆 𝘁𝗵𝗲 𝗽𝗲𝗿𝗺𝗶𝘀𝘀𝗶𝗼𝗻𝘀 they truly need.

🚫 You don’t need Enterprise Admins to manage endpoints.

𝗜𝗻𝘀𝘁𝗲𝗮𝗱:

✅ Implement a tiering model

✅ Separate scopes and admin accounts

✅ Limit access per tier

𝗦𝗼𝗺𝗲𝘁𝗵𝗶𝗻𝗴 𝘁𝗼 𝗵𝗲𝗹𝗽 𝘆𝗼𝘂 𝘂𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱 (𝗳𝗿𝗲𝗲):

𝗧𝗶𝗲𝗿𝗶𝗻𝗴 𝗠𝗼𝗱𝗲𝗹 𝗺𝗶𝗻𝗶-𝗰𝗼𝘂𝗿𝘀𝗲:

https://academy.horizon-secured.com/p/windows-infrastructure-security-tiering-model

𝗦𝗲𝗿𝘃𝗶𝗰𝗲 𝗔𝗰𝗰𝗼𝘂𝗻𝘁𝘀 𝗺𝗶𝗻𝗶-𝗰𝗼𝘂𝗿𝘀𝗲:

https://academy.horizon-secured.com/p/active-directory-service-accounts

🧠 Every time you grant privileges — 𝗽𝗮𝘂𝘀𝗲 𝗮𝗻𝗱 𝗾𝘂𝗲𝘀𝘁𝗶𝗼𝗻 𝗶𝘁.

Avoid shortcuts. Delegate intentionally. Stick to least privilege.