Privileged Users and Administrators

Administrators can typically reach any data, grant themselves further access, and alter or delete the records of having done so. Every control discussed elsewhere assumes logs that are trustworthy and permissions that are enforced — both of which this population can affect.

What makes it different

Legitimate access to everything. Content-based detection is nearly useless: an administrator reading a sensitive file is not anomalous.

Ability to affect the controls. Logging can be disabled, retention shortened, alerts suppressed, accounts created. Not necessarily maliciously — these are routine administrative functions.

Small population, poor baselines. Behavioural comparison needs peers. In a team of four, statistical anomaly detection produces noise.

Frequently the people who build the monitoring. An uncomfortable structural fact that governance has to address explicitly.

The controls that matter

Separate administrative accounts. Ordinary work in an ordinary account; elevation only when needed. This alone makes administrative activity distinguishable in logs, which is the precondition for everything else.

Just-in-time elevation. Standing privilege replaced by a request, an approval, a time limit and an automatic expiry. It converts continuous exposure into discrete, logged events.

Logging to somewhere they do not control. The single most important measure. Administrative activity written to a system the same administrators can alter is not evidence. Forward to a separate platform with different administration, retention they cannot shorten, and integrity protection.

Two-person control for the highest-consequence actions. Bulk export, changes to logging configuration, mass permission changes, deletion of audit data.

Session recording for the most sensitive access, where proportionate. This is intrusive and defensible for a small population with extraordinary access, in a way that it is not for general staff.

What to actually watch

Content inspection will not help. Watch the actions:

Permission grants, especially self-grants and grants to new accounts.

Account creation, particularly outside the normal provisioning process.

Changes to logging or retention configuration. Rare, high signal.

Access to data outside any current work. A database administrator opening HR records has no business reason, and this is one of the few high-precision signals available for this group.

Activity outside change windows for systems that have them.

Export from systems of record, at any volume.

The governance problem

If the security team administers the monitoring, and the security team is a privileged population, who watches them?

The standard answers, in order of practicality:

Separate administration of the log platform from the teams being logged. Different people, different credentials.

External review of privileged access audit trails — internal audit, or a periodic third-party review.

Access to monitoring data itself audited, with that audit reviewed outside the security function.

None is perfect. All are better than the common arrangement, which is that the people with the most access review their own records.

Contractors and third-party administrators

Frequently hold privileged access, sit outside HR processes, and are invisible to departure workflows.

Sponsor requirement. Every third-party account has a named internal owner responsible for its lifecycle.

Hard expiry. Time-bound by default, renewed deliberately.

Separate identity. Distinguishable from employee accounts in every log.

Departure notification written into the contract. You will not otherwise learn when their staff change.

The most common serious finding in access reviews is an active administrative account belonging to a contractor who left the supplier two years ago.

The proportionality argument

Higher scrutiny of privileged users is defensible in a way that broad workforce monitoring frequently is not. The access is extraordinary, the consequence is severe, the population is small, and the people concerned generally understand why.

If a programme has limited capacity, applying it here first is both more effective and easier to justify than applying it everywhere thinly.