Local administrator rights
The right of a user to install, change or switch off whatever they like on their own workstation; the cyber questionnaire asks how many accounts keep it, which ones and why.
Local administrator rights are the privileges that let an account install software, change settings and stop services on a given machine without going through IT. The cyber questionnaire asks it almost the same way every time: are your users administrators of their own workstations? June 27, 2017: NotPetya spread from a poisoned update of M.E.Doc, a Ukrainian accounting package. It pulled the credentials of logged-in accounts out of memory, then moved through PsExec and WMI (Windows Management Instrumentation) to every machine where those credentials opened an admin session. On a workstation where the user is local admin, malware inherits the same power: kill the antivirus, stop the EDR (endpoint detection and response) agent, read the memory of the LSASS process, where Windows keeps authentication secrets. Privilege escalation, the step the attacker would otherwise have to work for, comes free. For the underwriter the answer is hard to check: no external scan sees the rights on a laptop. So the underwriter asks for a share of the fleet, the list of exceptions and the tool that grants temporary elevation on request. Then cross-checks against the LAPS (Local Administrator Password Solution) question. If the built-in administrator password is identical across the fleet, stripping user rights closes one door out of two. A flat "no" with no exceptions is rarely accurate. Developers, executives and a few plant-floor machines tend to keep their rights, and that is where the underwriting call digs in.
Textbook case, made-up figures: a 400-seat manufacturer answers "no" to the local admin rights question. On the call, the IT director explains that 60 accounts still have them: 35 developers, 15 maintenance technicians, 10 executives. That is 15% of the fleet. The underwriter logs the answer as inaccurate, asks whether those 60 accounts go through temporary elevation and whether the built-in administrator password is unique per machine. Without a written reply, the file stays flagged for review before any quote.
local admin rights, local administrator privileges, end-user admin rights, workstation admin rights
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.