{"language":"en_GB","topic":{"id":"p181081i21","strTitle":"Topic 9: Privileged access","screens":[{"id":"p181081i21s01","strTitle":"Welcome","objNormalBackgroundSrc":{"strSrc":"95039\/95040\/generic_bg_03.jpg"},"objBackgroundVideo":{"mp4":"","webm":""},"assets":[{"id":"p181081i21s01a01","layoutId":null,"strContent":"Privileged access","strTextAlign":"left-align","active":1},{"id":"p181081i21s01a02","layoutId":null,"strContent":"Privileged access is defined as a heightened level of access to an IT system that could include functions such as changing configurations, creating user accounts, modifying permissions, starting and stopping the system, installing or activating components, or mass data updates (such as deletions or archiving).\n\nIn this topic, we will look at an issue relating to privileged access as you give your colleague, Yvonne, your advice. Then, we will explore some key things you need to know.\n\nThis topic will take approximately eight minutes to complete.","strTextAlign":"left-align","customTitle":false,"active":1},{"id":"p181081i21s01a03","layoutId":null,"strContent":"Select Start to continue.","strTextAlign":"left-align","active":1},{"id":"p181081i21s01a04","layoutId":null,"objNormalSrc":{"strSrc":"95039\/95041\/p181081i21s01a04.png","strAltText":""},"strImageAlignment":"left","active":1},{"id":"p181081i21s01a05","layoutId":"p181081i21s01lay01","objNormalSrc":{"strSrc":"95039\/95040\/ucisa_logo_retina.png","strAltText":""},"strImageAlignment":"left","active":1},{"id":"p181081i21s01a07","layoutId":"p181081i21s01lay01","strLabel":"Start","strAlignment":"left-align","objIconImageFilename":{"strSrc":""},"active":1}],"extras":{"objNavigationConfiguration":{}},"subscreens":[],"active":1},{"id":"p181081i21s02","strTitle":"Speeding things up","objNormalBackgroundSrc":{"strSrc":"95039\/95040\/generic_bg_04.jpg"},"objBackgroundVideo":{"mp4":"","webm":""},"assets":[{"id":"p181081i21s02a01","layoutId":null,"strContent":"Select your answer, then Confirm.","strTextAlign":"left-align","active":1},{"id":"p181081i21s02a02","layoutId":null,"strContent":"Yvonne has brought in a contractor to assist with some administrative tasks. There's a lot to do, and she isn't exactly sure what access the contractor will need. Yvonne asks the system administrator to give the contractor account full administrative access.","strTextAlign":"left-align","active":1},{"id":"p181081i21s02a03","layoutId":null,"strContent":"Speeding things up","strTextAlign":"left-align","active":1},{"id":"p181081i21s02a04","layoutId":null,"objNormalSrc":{"strSrc":"95039\/95041\/p181081i21s02a04.png","strAltText":"Yvonne (mid-30s, white, female)"},"strImageAlignment":"left","active":1},{"id":"p181081i21s02a05","layoutId":null,"strContent":"Select the next button to continue.","strTextAlign":"left-align","customTitle":false,"active":1},{"id":"p181081i21s02a08","layoutId":null,"arrOptions":[{"strOptionText":"Yes – it's important the contractor can get to work quickly so time and money aren't wasted.","arrOptionFeedbackActions":[{"strActionType":"showSubScreen","strActionGroup":"subscreen","objParameters":{"strSubScreenID":"p181081i21s02sub02","booAssetOwnedSubscreen":false},"strObjectType":"action"}]},{"strOptionText":"No – contractors should never be given administrative access to IT systems.","arrOptionFeedbackActions":[{"strActionType":"showSubScreen","strActionGroup":"subscreen","objParameters":{"strSubScreenID":"p181081i21s02sub03","booAssetOwnedSubscreen":false},"strObjectType":"action"}]},{"strOptionText":"No – the contractor should be given a minimal level of access for any work they need to do immediately, which can then be expanded or adjusted for future tasks.","arrOptionFeedbackActions":[{"strActionType":"showSubScreen","strActionGroup":"subscreen","objParameters":{"strSubScreenID":"p181081i21s02sub01","booAssetOwnedSubscreen":false},"strObjectType":"action"}]},{"strOptionText":"No – the contractor should be given the password for the administrator account, as it's not appropriate to assign administrative privileges to the contractor's own account.","arrOptionFeedbackActions":[{"strActionType":"showSubScreen","strActionGroup":"subscreen","objParameters":{"strSubScreenID":"p181081i21s02sub04","booAssetOwnedSubscreen":false},"strObjectType":"action"}]},{"strOptionText":"Yes – but they should activate a logging function on the account so any suspicious activity can be followed up.","arrOptionFeedbackActions":[{"strActionType":"showSubScreen","strActionGroup":"subscreen","objParameters":{"strSubScreenID":"p181081i21s02sub05","booAssetOwnedSubscreen":false},"strObjectType":"action"}]}],"arrFirstIncorrectActions":[{"strActionType":"createSubScreenFromText","strActionGroup":"preprocess","subscreenUuid":"8071050b-8c8f-4566-8577-679d904ff17c","objParameters":{"strTextToCreateSubScreenID":"","booAssetOwnedSubscreen":false},"strObjectType":"action"}],"active":1},{"id":"p181081i21s02a09","layoutId":"p181081i21s02lay01","strContent":"Is this appropriate? Why or why not?","strTextAlign":"left-align","active":1}],"extras":{"objNavigationConfiguration":{}},"subscreens":[{"id":"p181081i21s02sub01","strTitle":"Correct","assets":[{"id":"p181081i21s02sub01a01","layoutId":null,"strContent":"[b]That's right![\/b]\n\nAccess should be given based on the least privilege needed to do the job.\n\nUnless the contractor was specifically hired for system administration purposes and is appropriately experienced and qualified, giving them full access is excessive and exposes the organisation to risk. They certainly should not be given the password to a general administration account, as, under these conditions, it won't be possible to trace any actions they take back to them.\n\nAdditionally, while logging activities is a sensible precaution, it is not a substitute for assigning the correct permissions in the first place, and it is always better to avoid a problem rather than react to an avoidable incident.","strTextAlign":"left-align","active":1},{"id":"p181081i21s02sub01a03","layoutId":null,"objNormalSrc":{"strSrc":"95039\/95040\/feed_correct_icon.png","strAltText":""},"strImageAlignment":"left","active":1},{"id":"p181081i21s02sub01a04","layoutId":"p181081i21s02sub01lay01","strLabel":"Continue","strAlignment":"left-align","objIconImageFilename":{"strSrc":""},"active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p181081i21s02sub02","strTitle":"Incorrect 1","assets":[{"id":"p181081i21s02sub02a01","layoutId":null,"strContent":"[b]That's not quite right...[\/b]\n\nUnless the contractor was specifically hired for system administration purposes and is appropriately experienced and qualified, giving them this level of access is excessive and exposes the organisation to risk.","strTextAlign":"left-align","active":1},{"id":"p181081i21s02sub02a03","layoutId":null,"objNormalSrc":{"strSrc":"95039\/95040\/feed_incorrect_icon.png","strAltText":""},"strImageAlignment":"left","active":1},{"id":"p181081i21s02sub02a04","layoutId":"p181081i21s02sub02lay01","strLabel":"Continue","strAlignment":"left-align","objIconImageFilename":{"strSrc":""},"active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p181081i21s02sub03","strTitle":"Incorrect 2","assets":[{"id":"p181081i21s02sub03a01","layoutId":null,"objNormalSrc":{"strSrc":"95039\/95040\/feed_incorrect_icon.png","strAltText":""},"strImageAlignment":"left","active":1},{"id":"p181081i21s02sub03a02","layoutId":null,"strContent":"[b]That's not quite right... [\/b]\n\nThe contractor should not have administrative access because there is no clear need for them to have it. If the contractor were employed specifically to do system administration work for which they were experienced and qualified, then it might be appropriate.","strTextAlign":"left-align","customTitle":false,"active":1},{"id":"p181081i21s02sub03a03","layoutId":null,"strContent":"Select Next to continue.","strTextAlign":"left-align","active":1},{"id":"p181081i21s02sub03a04","layoutId":"p181081i21s02sub03lay01","strLabel":"Continue","strAlignment":"left-align","objIconImageFilename":{"strSrc":""},"active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p181081i21s02sub04","strTitle":"Incorrect 3","assets":[{"id":"p181081i21s02sub04a02","layoutId":"p181081i21s02sub04lay00","strContent":"[b]That's not quite right... [\/b]\n\nThe contractor should not have administrative access because there is no clear need for them to have it. They certainly should not be given the password to a general administration account, as, under these conditions, it won't be possible to trace any actions they take back to them.","strTextAlign":"left-align","customTitle":false,"active":1},{"id":"p181081i21s02sub04a03","layoutId":"p181081i21s02sub04lay00","objNormalSrc":{"strSrc":"95039\/95040\/feed_incorrect_icon.png","strAltText":""},"strImageAlignment":"left","active":1},{"id":"p181081i21s02sub04a04","layoutId":"p181081i21s02sub04lay00","strLabel":"Continue","strAlignment":"left-align","objIconImageFilename":{"strSrc":""},"active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p181081i21s02sub05","strTitle":"Incorrect 4","assets":[{"id":"p181081i21s02sub05a01","layoutId":"p181081i21s02sub05lay00","strContent":"[b]That's not quite right... [\/b]\n\nThe contractor should not have administrative access because there is no clear need for them to have it. Logging activities is a sensible precaution, but it is not a substitute for assigning the correct permissions in the first place.","strTextAlign":"left-align","customTitle":false,"active":1},{"id":"p181081i21s02sub05a03","layoutId":"p181081i21s02sub05lay00","objNormalSrc":{"strSrc":"95039\/95040\/feed_incorrect_icon.png","strAltText":""},"strImageAlignment":"left","active":1},{"id":"p181081i21s02sub05a04","layoutId":"p181081i21s02sub05lay00","strLabel":"Continue","strAlignment":"left-align","objIconImageFilename":{"strSrc":""},"active":1}],"extras":{"scalar":""},"subscreens":[],"active":1}],"active":1},{"id":"p181081i21s03","strTitle":"Key takeaways","objNormalBackgroundSrc":{"strSrc":"95039\/95041\/generic_bg_02.jpg"},"objBackgroundVideo":{"mp4":"","webm":""},"assets":[{"id":"p181081i21s03a01","layoutId":null,"strContent":"Key takeaways","strTextAlign":"left-align","active":1},{"id":"p181081i21s03a02","layoutId":null,"strContent":"Let's examine the key takeaways from this topic.\n\nIf you have an account with privileged access:\n[list]\n[*]Use it only when you absolutely need that level of access.\n[*]Make sure it has a strong password and uses multi-factor authentication (MFA).\n[*]Use it only on trusted devices that are protected against malware and other threats.\n[*]If you suspect that the password has become known to someone else, change it immediately and report it as a potential security incident.\n[\/list]\n","strTextAlign":"left-align","customTitle":false,"active":1},{"id":"p181081i21s03a03","layoutId":null,"strContent":"Select the next button to continue.","strTextAlign":"left-align","customTitle":false,"active":1},{"id":"p181081i21s03a04","layoutId":null,"objNormalSrc":{"strSrc":"95039\/95041\/p181081i21s03a04.png","strAltText":""},"strImageAlignment":"left","active":1}],"extras":{"objNavigationConfiguration":{}},"subscreens":[],"active":1},{"id":"p181081i21s04","strTitle":"Knowledge check","objNormalBackgroundSrc":{"strSrc":"95039\/95040\/generic_bg_05.jpg"},"objBackgroundVideo":{"mp4":"","webm":""},"assets":[{"id":"p181081i21s04a01","layoutId":null,"strContent":"Which of the following statements about privileged access are correct?","strTextAlign":"centre-align","active":1},{"id":"p181081i21s04a02","layoutId":null,"arrOptions":[{"strOptionText":"Privileged access should be granted at the minimum level required to do the job."},{"strOptionText":"Privileged access accounts should be given generic names such as 'Admin' or 'Data Manager'."},{"strOptionText":"An account with privileged access can cause significant harm (either intentionally or accidentally) to IT systems and data if it falls into the wrong hands."},{"strOptionText":"Accounts with privileged access should have strong passwords and be protected by multi-factor authentication."}],"arrCorrectActions":[{"strActionType":"showSubScreen","strActionGroup":"subscreen","objParameters":{"strSubScreenID":"p181081i21s04sub01","booAssetOwnedSubscreen":false},"strObjectType":"action"}],"arrFinalIncorrectActions":[{"strActionType":"showSubScreen","strActionGroup":"subscreen","objParameters":{"strSubScreenID":"p181081i21s04sub02","booAssetOwnedSubscreen":false},"strObjectType":"action"}],"arrFirstIncorrectActions":[{"strActionType":"showSubScreen","strActionGroup":"subscreen","objParameters":{"strSubScreenID":"p181081i21s04sub02","booAssetOwnedSubscreen":false},"strObjectType":"action"}],"active":1},{"id":"p181081i21s04a03","layoutId":null,"strContent":"Select all the correct answers, then Confirm.","strTextAlign":"centre-align","active":1},{"id":"p181081i21s04a04","layoutId":null,"strContent":"Knowledge check","strTextAlign":"centre-align","active":1},{"id":"p181081i21s04a05","layoutId":null,"strContent":"Select the next button to continue.","strTextAlign":"centre-align","customTitle":false,"active":1},{"id":"p181081i21s04a06","layoutId":"p181081i21s04lay02","objNormalSrc":{"strSrc":"95039\/95041\/knowledge_check.png","strAltText":""},"strImageAlignment":"center","active":1}],"extras":{"objNavigationConfiguration":{}},"subscreens":[{"id":"p181081i21s04sub01","strTitle":"Correct","assets":[{"id":"p181081i21s04sub01a01","layoutId":null,"strContent":"[b]That's right!\n [\/b]\nThe correct statements are:\n[list]\n[*]Privileged access should be granted at the minimum level required to do the job.\n[*]An account with privileged access can cause significant harm (either intentionally or accidentally) to IT systems and data if it falls into the wrong hands.\n[*]Accounts with privileged access should have strong passwords and be protected by multi-factor authentication.\n[\/list]\nPrivileged access accounts should always be linked to a named individual.","strTextAlign":"left-align","customTitle":false,"active":1},{"id":"p181081i21s04sub01a02","layoutId":null,"objNormalSrc":{"strSrc":"95039\/95040\/feed_correct_icon.png","strAltText":""},"strImageAlignment":"left","active":1},{"id":"p181081i21s04sub01a03","layoutId":null,"strLabel":"Continue","strAlignment":"left-align","objIconImageFilename":{"strSrc":""},"active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p181081i21s04sub02","strTitle":"Incorrect","assets":[{"id":"p181081i21s04sub02a01","layoutId":null,"strContent":"[b]That's not quite right...[\/b]\n[b] [\/b]\nThe correct statements are:\n[list]\n[*]Privileged access should be granted at the minimum level required to do the job.\n[*]An account with privileged access can cause significant harm (either intentionally or accidentally) to IT systems and data if it falls into the wrong hands.\n[*]Accounts with privileged access should have strong passwords and be protected by multi-factor authentication.\n[\/list]\nPrivileged access accounts should always be linked to a named individual.","strTextAlign":"left-align","customTitle":false,"active":1},{"id":"p181081i21s04sub02a02","layoutId":null,"objNormalSrc":{"strSrc":"95039\/95040\/feed_incorrect_icon.png","strAltText":""},"strImageAlignment":"left","active":1},{"id":"p181081i21s04sub02a03","layoutId":null,"strLabel":"Try again","strAlignment":"left-align","objIconImageFilename":{"strSrc":""},"active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p181081i21s04sub03","strTitle":"Well done!","assets":[{"id":"p181081i21s04sub03a01","layoutId":null,"strContent":"​Well done!","strTextAlign":"left-align","active":1},{"id":"p181081i21s04sub03a02","layoutId":null,"strContent":"Congratulations, you have now completed this topic. Please feel free to revisit any part of this topic before you go.","strTextAlign":"left-align","active":1},{"id":"p181081i21s04sub03a04","layoutId":"p181081i21s04sub03lay01","objNormalSrc":{"strSrc":"95039\/95041\/topic_complete_sub.png","strAltText":""},"strImageAlignment":"left","active":1},{"id":"p181081i21s04sub03a05","layoutId":"p181081i21s04sub03lay01","strLabel":"Continue","strAlignment":"left-align","objIconImageFilename":{"strSrc":""},"active":1}],"extras":{"scalar":""},"subscreens":[],"active":1}],"active":1},{"id":"p181081i21s05","strTitle":"Managing Privileged Access","objNormalBackgroundSrc":{"strSrc":"95039\/95040\/generic_bg_03.jpg"},"objBackgroundVideo":{"mp4":"","webm":""},"assets":[{"id":"p181081i21s05a01","layoutId":null,"strContent":"Managing Privileged Access","strTextAlign":"left-align","active":1},{"id":"p181081i21s05a02","layoutId":null,"strContent":"As with all access, privileged access should be at the minimum level required to do the job.\n\nGranting privileged access should be subject to a robust procedure that ensures that it is given only where essential for the job role, and that, similarly, it is removed as soon as it is no longer needed. Privileged access should only be given to named individuals who have had appropriate training\/guidance and are aware of the responsibilities that such permissions entail.","strTextAlign":"left-align","customTitle":false,"active":1},{"id":"p181081i21s05a03","layoutId":null,"strContent":"Select the next button to answer the question again.","strTextAlign":"left-align","customTitle":false,"active":1},{"id":"p181081i21s05a04","layoutId":null,"objNormalSrc":{"strSrc":"95039\/95041\/p181081i21s05.png","strAltText":""},"strImageAlignment":"left","active":1}],"extras":{"objNavigationConfiguration":{}},"subscreens":[],"active":1},{"id":"p181081i21s06","strTitle":"Managing access","objNormalBackgroundSrc":{"strSrc":"95039\/95040\/generic_bg_06.jpg"},"objBackgroundVideo":{"mp4":"","webm":""},"assets":[{"id":"p181081i21s06a01","layoutId":null,"strContent":"Select each icon to learn more.","strTextAlign":"centre-align","active":1},{"id":"p181081i21s06a02","layoutId":null,"strContent":"It's essential to follow best practices when managing or having privileged access. Select each icon below to explore what you should consider.","strTextAlign":"centre-align","active":1},{"id":"p181081i21s06a03","layoutId":null,"strContent":"Managing access","strTextAlign":"centre-align","active":1},{"id":"p181081i21s06a04","layoutId":null,"strAlignment":"centre-alignC","objNormalSrc":{"strSrc":"95039\/95041\/p181081i21s06_01_n.png","strAltText":""},"objActiveSrc":{"strSrc":"95039\/95041\/p181081i21s06_01_h.png"},"objVisitedSrc":{"strSrc":"95039\/95041\/p181081i21s06_01_v.png"},"arrHotspots":[{"strText":"Risks associated with privileged access","objCoords":{"intTop":"0","intLeft":"0","intWidth":"200","intHeight":"236"}}],"active":1},{"id":"p181081i21s06a05","layoutId":null,"strAlignment":"centre-alignC","objNormalSrc":{"strSrc":"95039\/95041\/p181081i21s06_02_n.png","strAltText":""},"objActiveSrc":{"strSrc":"95039\/95041\/p181081i21s06_02_h.png"},"objVisitedSrc":{"strSrc":"95039\/95041\/p181081i21s06_02_v.png"},"arrHotspots":[{"strText":"Maintaining security","objCoords":{"intTop":"0","intLeft":"0","intWidth":"200","intHeight":"236"}}],"active":1},{"id":"p181081i21s06a06","layoutId":null,"strContent":"Select another icon.","strTextAlign":"centre-align","active":1},{"id":"p181081i21s06a07","layoutId":null,"strContent":"Select the next button to continue.","strTextAlign":"centre-align","customTitle":false,"active":1},{"id":"p181081i21s06a08","layoutId":null,"strAlignment":"centre-alignC","objNormalSrc":{"strSrc":"95039\/95041\/p181081i21s06_03_n.png","strAltText":""},"objActiveSrc":{"strSrc":"95039\/95041\/p181081i21s06_03_h.png"},"objVisitedSrc":{"strSrc":"95039\/95041\/p181081i21s06_03_v.png"},"arrHotspots":[{"strText":"Best practice","objCoords":{"intTop":1,"intLeft":1,"intWidth":199,"intHeight":218}}],"active":1}],"extras":{"objNavigationConfiguration":{}},"subscreens":[{"id":"p181081i21s06sub01","strTitle":"Risks associated with privileged access","assets":[{"id":"p181081i21s06sub01a01","layoutId":null,"strContent":"An account with privileged access can cause significant harm to IT systems and data if it falls into the wrong hands. For example, a privileged account may be able to:\n[list]\n[*]Extract large volumes of data, including confidential data.\n[*]Corrupt or delete critical data.\n[*]Remove security controls from the system to facilitate further attacks.\n[*]Create additional privileged accounts to maintain or extend illicit access.\n[*]Delete logs and audit records to cover its tracks.\n[*]Render the system unusable and unavailable.\n[\/list]\nIt is therefore essential that accounts with administrative privileges be carefully protected.\n\nPrivileged access can also lead to accidental harm if it is given to someone who lacks the expertise to use it correctly or doesn't understand the risks. Individuals granted privileged access should understand the system, the risks, and any associated expectations.","strTextAlign":"left-align","customTitle":false,"active":1},{"id":"p181081i21s06sub01a04","layoutId":null,"strContent":"Risks associated with privileged access","strTextAlign":"left-align","active":1},{"id":"p181081i21s06sub01a05","layoutId":"p181081i21s06sub01lay01","objNormalSrc":{"strSrc":"95039\/95041\/p181081i21s06_01_sub.png","strAltText":""},"strImageAlignment":"left","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p181081i21s06sub02","strTitle":"Maintaining security","assets":[{"id":"p181081i21s06sub02a01","layoutId":null,"strContent":"Accounts with privileged access should have strong passwords and be protected by multi-factor authentication.\n\nFor higher levels of privileged access in particular, other checks could also be performed prior to allowing access, such as verifying the location of the connecting device and\/or whether it meets minimum security standards.","strTextAlign":"left-align","customTitle":false,"active":1},{"id":"p181081i21s06sub02a04","layoutId":null,"strContent":"Maintaining security","strTextAlign":"left-align","active":1},{"id":"p181081i21s06sub02a05","layoutId":"p181081i21s06sub02lay01","objNormalSrc":{"strSrc":"95039\/95041\/p181081i21s06_02_sub.png","strAltText":""},"strImageAlignment":"left","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p181081i21s06sub03","strTitle":"Best practice","assets":[{"id":"p181081i21s06sub03a01","layoutId":null,"strContent":"Best practice","strTextAlign":"left-align","active":1},{"id":"p181081i21s06sub03a02","layoutId":null,"strContent":"Privileged access accounts should be linked to a named individual. Shared accounts such as 'administrator' and 'root' should not be used.\n\nHowever, privileged access should be attached to an account that is not used for day-to-day activities such as reading emails or accessing websites. This is to reduce the risk of the account being compromised by malware or a malicious site. This means that some individuals will need more than one IT account.\n\nFor example, if someone needs administrative control over their laptop, this should be provided through a separate account, not assigned to the primary account that is used for day-to-day work.\n\nActions taken by privileged accounts should be logged and audited so any suspicious activity can be investigated. Ideally, logs should be analysed automatically to detect anomalies.","strTextAlign":"left-align","active":1},{"id":"p181081i21s06sub03a05","layoutId":"p181081i21s06sub03lay01","objNormalSrc":{"strSrc":"95039\/95041\/p181081i21s06_03_sub.png","strAltText":""},"strImageAlignment":"left","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1}],"active":1}],"active":true}}