mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-29 23:46:53 +03:00
mukul975
efca3ec611
Mapped every skill to NIST CSF 2.0 subcategory IDs (GV/ID/PR/DE/RS/RC functions) based on subdomain and content analysis. Restores 11 skills corrupted during prior rebase, re-enriching with ATLAS, D3FEND, NIST AI RMF, and CSF 2.0 fields. All 754 skills now carry structured mappings for all 5 security frameworks: - MITRE ATT&CK (in tags) - MITRE ATLAS v5.5 (atlas_techniques) - MITRE D3FEND v1.3 (d3fend_techniques) - NIST AI RMF 1.0 (nist_ai_rmf) - NIST CSF 2.0 (nist_csf)
173 lines
7.6 KiB
Markdown
173 lines
7.6 KiB
Markdown
---
|
|
name: performing-privileged-account-access-review
|
|
description: Conduct systematic reviews of privileged accounts to validate access rights, identify excessive permissions,
|
|
and enforce least privilege across PAM infrastructure.
|
|
domain: cybersecurity
|
|
subdomain: identity-access-management
|
|
tags:
|
|
- pam
|
|
- access-review
|
|
- privileged-accounts
|
|
- least-privilege
|
|
- compliance
|
|
- audit
|
|
- identity-governance
|
|
version: '1.0'
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
nist_csf:
|
|
- PR.AA-01
|
|
- PR.AA-02
|
|
- PR.AA-05
|
|
- PR.AA-06
|
|
---
|
|
|
|
# Performing Privileged Account Access Review
|
|
|
|
## Overview
|
|
|
|
Privileged Account Access Review is a critical identity governance process that validates whether users with elevated permissions still require their access. This review covers domain admins, service accounts, database administrators, cloud IAM roles, and application-level privileged accounts. Regular access reviews are mandated by SOC 2, PCI DSS, HIPAA, and SOX compliance frameworks, typically required quarterly for high-privilege accounts.
|
|
|
|
|
|
## When to Use
|
|
|
|
- When conducting security assessments that involve performing privileged account access review
|
|
- When following incident response procedures for related security events
|
|
- When performing scheduled security testing or auditing activities
|
|
- When validating security controls through hands-on testing
|
|
|
|
## Prerequisites
|
|
|
|
- PAM solution deployed (CyberArk, BeyondTrust, Delinea, or equivalent)
|
|
- Identity governance platform (SailPoint, Saviynt, or equivalent)
|
|
- Complete inventory of privileged accounts across all platforms
|
|
- Defined access review policy with SLAs and escalation procedures
|
|
- Designated reviewers (account owners, managers, security team)
|
|
|
|
## Core Concepts
|
|
|
|
### Privileged Account Categories
|
|
|
|
| Category | Examples | Risk Level | Review Frequency |
|
|
|----------|----------|------------|-----------------|
|
|
| Domain Admins | Enterprise Admin, Domain Admin, Schema Admin | Critical | Monthly |
|
|
| Service Accounts | SQL service, backup agents, monitoring agents | High | Quarterly |
|
|
| Cloud IAM | AWS root, Azure Global Admin, GCP Owner | Critical | Monthly |
|
|
| Database Admin | DBA accounts, sa/sys accounts | High | Quarterly |
|
|
| Application Admin | App admin roles, API keys with admin scope | Medium | Semi-annually |
|
|
| Emergency/Break-glass | Firecall accounts, emergency access | Critical | After each use |
|
|
|
|
### Four-Pillar Review Framework
|
|
|
|
```
|
|
DISCOVER VALIDATE REMEDIATE MONITOR
|
|
│ │ │ │
|
|
├─ Enumerate all ├─ Verify business ├─ Remove excess ├─ Continuous
|
|
│ privileged accounts │ justification │ privileges │ monitoring
|
|
│ │ │ │
|
|
├─ Identify orphaned ├─ Confirm account ├─ Disable orphaned ├─ Anomaly
|
|
│ accounts │ ownership │ accounts │ detection
|
|
│ │ │ │
|
|
├─ Map permissions to ├─ Check compliance ├─ Enforce password ├─ Session
|
|
│ business roles │ with policies │ rotation │ recording
|
|
│ │ │ │
|
|
└─ Classify by risk └─ Review last usage └─ Implement JIT └─ Audit
|
|
level and activity access logging
|
|
```
|
|
|
|
## Workflow
|
|
|
|
### Step 1: Account Discovery and Inventory
|
|
|
|
Enumerate all privileged accounts across the environment:
|
|
|
|
**Active Directory:**
|
|
- Domain Admins, Enterprise Admins, Schema Admins groups
|
|
- Accounts with AdminCount=1 attribute
|
|
- Service accounts with SPN (Service Principal Names)
|
|
- Accounts with delegation rights (Unconstrained/Constrained)
|
|
|
|
**Cloud Platforms:**
|
|
- AWS: IAM users/roles with AdministratorAccess, PowerUserAccess, or `iam:*` permissions
|
|
- Azure: Global Administrator, Privileged Role Administrator, Security Administrator roles
|
|
- GCP: Owner, Editor roles at organization/project level
|
|
|
|
**Databases:**
|
|
- SQL Server: sysadmin, db_owner, securityadmin fixed roles
|
|
- Oracle: DBA, SYSDBA, SYSOPER privileges
|
|
- PostgreSQL: superuser, createrole, createdb attributes
|
|
|
|
### Step 2: Establish Review Criteria
|
|
|
|
Each privileged account must be evaluated against:
|
|
|
|
1. **Business Justification**: Does the user's current role require this privilege?
|
|
2. **Least Privilege**: Can the task be performed with lower privileges?
|
|
3. **Account Activity**: Has the account been active in the last 90 days?
|
|
4. **Compliance Status**: Does the account meet password policy, MFA requirements?
|
|
5. **Separation of Duties**: Does the access create SoD conflicts?
|
|
6. **Ownership**: Is a responsible owner assigned and active?
|
|
|
|
### Step 3: Conduct the Review
|
|
|
|
For each account, the designated reviewer must:
|
|
|
|
1. Review the account details, permissions, and last activity date
|
|
2. Approve (certify) the access if still required with documented justification
|
|
3. Revoke access if no longer needed or the reviewer cannot justify the privilege
|
|
4. Flag for investigation if anomalous activity or policy violations are detected
|
|
5. Escalate if the reviewer cannot make a determination
|
|
|
|
Decision matrix:
|
|
|
|
| Condition | Action |
|
|
|-----------|--------|
|
|
| Active user, justified privilege | Certify - maintain access |
|
|
| Active user, excessive privilege | Remediate - reduce to least privilege |
|
|
| Inactive > 90 days | Disable account, notify owner |
|
|
| No owner identified | Disable account, escalate to security |
|
|
| SoD conflict detected | Remediate - reassign or add compensating controls |
|
|
| Break-glass account | Verify last use was authorized, reset credentials |
|
|
|
|
### Step 4: Remediation and Enforcement
|
|
|
|
After reviews are completed:
|
|
|
|
- Revoke access for accounts that were not certified within the SLA period
|
|
- Implement automatic revocation for accounts not reviewed within 14 days
|
|
- Rotate credentials for all certified privileged accounts
|
|
- Convert standing privileges to just-in-time (JIT) access where possible
|
|
- Update PAM vault with current account inventory
|
|
|
|
### Step 5: Reporting and Documentation
|
|
|
|
Generate review reports including:
|
|
|
|
- Total accounts reviewed vs. total in scope
|
|
- Certification rate (approved vs. revoked)
|
|
- Average review completion time
|
|
- Overdue reviews and escalations
|
|
- Remediation actions taken
|
|
- Comparison with previous review cycle
|
|
|
|
## Validation Checklist
|
|
|
|
- [ ] Complete inventory of all privileged accounts documented
|
|
- [ ] All accounts assigned to a responsible owner/reviewer
|
|
- [ ] Review criteria and decision matrix defined
|
|
- [ ] Reviewers completed certification within SLA (14 days)
|
|
- [ ] Revoked accounts disabled and credentials rotated
|
|
- [ ] Orphaned accounts identified and disabled
|
|
- [ ] Service accounts reviewed for least privilege
|
|
- [ ] Break-glass accounts audited for authorized use only
|
|
- [ ] Review report generated with metrics and trends
|
|
- [ ] Remediation tickets created and tracked to completion
|
|
- [ ] Evidence preserved for compliance audit
|
|
|
|
## References
|
|
|
|
- [NIST SP 800-53 AC-2: Account Management](https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/)
|
|
- [CIS Controls v8 - Control 5: Account Management](https://www.cisecurity.org/controls/account-management)
|
|
- [Netwrix PAM Best Practices Guide](https://netwrix.com/en/resources/guides/privileged-account-management-best-practices/)
|
|
- [StrongDM PAM Best Practices 2025](https://www.strongdm.com/blog/privileged-access-management-best-practices)
|