Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Who decides…

Who approves temporary administrator rights, and for how long?

9 decision pointsThe pack behind this answer: Privileged Access Management

Add to board memo

The short answer

Recommendation
Someone independent of the user and of whoever grants the rights approves each elevation, by tier. By the pack's defaults that is the Head of IT for Tier 0 (the Head of Information Security when the Head of IT asks), for at most 4 hours, and the system owner or the Head of IT for Tier 1, for at most 8 hours. The window is the shorter of what the task needs and that maximum.
Reasoning
Approving access and granting it are kept apart because one person doing both can give power to themselves or others unseen. The tier sets both the approver and the longest window. A short window is easier to approve and to review, and less useful to anyone who steals the session. The system switches the rights off at the end, so nobody has to remember to remove them, and an unfinished task needs a new approval.
Considerations
  • The 4-hour and 8-hour maximums and the 1-working-day limit for recording a phone approval are the CISO Times privileged access pack's defaults. Your standard may shorten them; the pack advises against lengthening them.
  • Out of hours, an approver on the on-call list approves by phone for at most 4 hours, never the requester. If the normal administration route itself is down, that is a break-glass use, with its own rules.
  • A supplier's engineer uses a named account enabled only for the window the system owner sets, with the Head of IT as well for Tier 0. The tier's maximum still applies.
  • Anything the standard does not allow is an exception approved at its band's level. At Critical that is the board, or a board risk committee it has delegated this to; the management board in a two-tier structure; or executive management where there is no board.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartSomeone asks for temporary administrator rightsDecisionIs the ticket complete?OutcomeReturn it with what is missingDecisionWhat is being asked for?StepUse the account approvers for the tierDecisionIs it out of hours, with no normal approver reachable?StepPhone an approver on the on-call listDecisionWhich tier is the system in?StepHead of IT approves, for at most 4 hoursStepSystem owner or Head of IT approves, for at most 8 hoursStepIT Operations Manager approves Tier 2 rightsDecisionIs the person a supplier's engineer?StepThe system owner sets the supplier's windowDecisionIs the approver independent of the user and the granter?OutcomePass it to another approver on the tableDecisionAre the account and its device of the system's tier?DecisionIs the window no longer than the task needs, within the maximum?StepShorten the window, or split the taskDecisionDo the rights create a conflict of duties?OutcomeRefuse the request as it standsOutcomeApprove, then let the system end the rightsOutcomeTreat it as an exception, approved at its band's level

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 22 steps.

  1. Start

    Someone asks for temporary administrator rights

    Every elevation and every new privileged account is approved by someone other than the person who will use it, and the approver never grants it by hand. Before asking, the administrator opens a ticket naming the account, the system and its tier, the rights, the reason and the start and end, and checks that the account, the sign-in method and the administration device fit that tier.

    In the pack

  2. Decision

    Is the ticket complete?

    The approver asks the pack's five questions in this order and stops at the first that settles it: is the ticket complete, am I independent, are the account and device of the system's tier, is the window right, and is there a conflict of duties. The steps between the first two only find the right approver and the window's maximum. The ticket names the account, system, tier, rights, reason, start and end. Not sure counts as no.

    In the pack

  3. Outcome

    Return it with what is missing

    An approval given on an incomplete ticket cannot be checked later: the session review matches every elevation to its ticket's window, system and rights. Send it back with what is missing, and decide once it is complete.

    In the pack

  4. Decision

    What is being asked for?

    An elevation switches eligible rights on for one task and a set time. A new administrator account, or a standing right, has no time window and its own approvers. A request for something the standard does not allow, such as standing Tier 1 rights for a supplier's accounts between windows, is a departure from the standard and needs an exception.

    In the pack

  5. Step

    Use the account approvers for the tier

    A new Tier 0 administrator account, or any standing right in Tier 0, needs the Head of IT and the Head of Information Security, both. A new Tier 1 administrator account or application administrator role needs the system owner and the Head of IT. A Tier 2 administrator account needs the IT Operations Manager. None has a time window. Each account goes in the inventory, and privileged access is reviewed every 3 months.

    In the pack

  6. Decision

    Is it out of hours, with no normal approver reachable?

    Out of hours, rights may be approved through the on-call route. It still needs an independent approver: urgency is never approval, and silence is never treated as one. If the normal administration route itself is down, it is a break-glass use, with its own rules.

    In the pack

    See also

  7. Step

    Phone an approver on the on-call list

    Open a ticket with the reason first, even a one-line one. Phone an approver on the on-call list, never yourself; the approver approves by phone with the window and notes the time. The window is at most 4 hours, the Tier 0 maximum, and the approval goes on the ticket within 1 working day. The elevation then joins the next session review.

    In the pack

  8. Decision

    Which tier is the system in?

    Tier 0 is the identity and control plane, Tier 1 servers, applications and cloud workloads, and Tier 2 end-user devices and user support. The tier sets both the approver and the longest window. A system with no tier has no rule to apply, so give it one; until then, treating it as Tier 0 is the cautious course.

    In the pack

  9. Step

    Head of IT approves, for at most 4 hours

    Tier 0 elevation is approved by the Head of IT, or by the Head of Information Security when the requester is the Head of IT or the Head of IT is unavailable. The longest window is 4 hours by the pack's default, whatever the approval says. In the pack's example, each of the Head of IT's own Tier 0 elevations was approved by the Head of Information Security.

    In the pack

  10. Step

    System owner or Head of IT approves, for at most 8 hours

    Tier 1 elevation is approved by the system owner of the system concerned, or by the Head of IT, for at most 8 hours by the pack's default. If one of them is not independent of the request, it passes to the other.

    In the pack

  11. Step

    IT Operations Manager approves Tier 2 rights

    The IT Operations Manager approves Tier 2 rights, including the separate Tier 2 account, which may hold standing rights so that day-to-day support needs no elevation. Where a Tier 2 right is switched on for a time, the longest window is 8 hours by the pack's default. A Tier 2 account never holds rights in Tier 0 or Tier 1.

    In the pack

  12. Decision

    Is the person a supplier's engineer?

    A supplier's engineers use named accounts, enabled only for the agreed window and logged; a shared supplier account is not allowed. Before approval, the request shows the engineer's named account and an approved window.

    In the pack

  13. Step

    The system owner sets the supplier's window

    The system owner sets the window, with the Head of IT as well for Tier 0. The window is at most 8 hours, and 4 hours in Tier 0: a supplier cannot use its own longer window to get round the tier's maximum, and the shorter approved window wins. The account is enabled for the window only. The supplier contract's access clause has the supplier remove access within 1 working day of a person leaving the supplier or no longer needing it. Where you hold the account, the pack disables it the same day you learn of the leaver.

    In the pack

    See also

  14. Decision

    Is the approver independent of the user and the granter?

    This is the approver's second question, asked once the steps above have named who approves. The approver is not the person using the rights, not the person who will grant them by hand, and not someone the requester approves for. In a small team where nobody else qualifies, the pack's tailoring has the Head of Information Security or a director approve Tier 0 elevations. Not sure counts as no.

    In the pack

  15. Outcome

    Pass it to another approver on the table

    Approving access and granting it are kept apart because one person doing both can give power to themselves or others unseen: it is a High conflict in the segregation-of-duties matrix. Pass the request to the other approver for that row, or to the Head of Information Security for the Head of IT's own requests.

    In the pack

    See also

  16. Decision

    Are the account and its device of the system's tier?

    The account must belong to the system's tier, and the administrator must work from an administration device of the same tier. The pack refuses a cross-tier elevation as a tier breach waiting to happen: a higher-tier credential typed on a lower-tier system can be captured there. Not known counts as no.

    In the pack

  17. Decision

    Is the window no longer than the task needs, within the maximum?

    Ask for the window the task needs, not the tier's maximum. A short window is easier to approve and to review, and less useful to anyone who steals the session. The rights end at the earlier of the approved end and the tier's maximum. A new account has no window, so it passes this question.

    In the pack

  18. Step

    Shorten the window, or split the task

    Cut the window to what the task needs, or split a long task into parts that each get their own approval. An unfinished task needs a new approval; the window is never extended on the same ticket.

    In the pack

  19. Decision

    Do the rights create a conflict of duties?

    Check the new rights against the segregation-of-duties matrix. For example, an administrator role in the finance system is never held by someone who posts transactions in it. The pack refuses a conflict unless an exception for it has been approved. Not known counts as yes.

    In the pack

  20. Outcome

    Refuse the request as it stands

    Refuse a cross-tier elevation, and rights that create a conflict of duties with no approved exception. The administrator can come back with an account and device of the right tier, or with narrower rights. Urgency is never approval.

    In the pack

  21. Outcome

    Approve, then let the system end the rights

    Put the approval, with its time and the approver's name, on the ticket before the start. For an elevation, the administrator switches the rights on for the approved task only, works from the administration device of the tier, and confirms the rights switched off at the end. The session review then matches the elevation to its ticket.

    In the pack

  22. Outcome

    Treat it as an exception, approved at its band's level

    A departure from the standard is an exception, scored and approved by the approver its band sets: the Head of Information Security for Medium, and for Critical the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, executive management. A rule moved to a later date on an approved plan is a transition, not an exception, while the plan holds. In the pack's example, a supplier's standing Tier 1 rights were a Medium exception.

    In the pack

Practical checklist

  1. Open a ticket naming the account, system, tier, rights, reason, start and end. Return an incomplete one.
  2. Confirm the approver is not the user, not the person granting the rights by hand, and not someone they approve for.
  3. Refuse the request if the account or the administration device is not of the system's tier.
  4. Set the window to what the task needs, within the tier's maximum, or split the task.
  5. Check the rights against the segregation-of-duties matrix, and refuse a conflict that has no approved exception.
  6. Record the approval, with its time and the approver's name, on the ticket before the start.
  7. Let the system end the rights at the earlier of the approved end and the tier's maximum, and confirm they switched off.
  8. Get a new approval for an unfinished task. Never extend the window on the same ticket.

Evidence to have ready

  • The ticket for each elevation: account, system, tier, rights, reason, approved window, approver and approval time.
  • The actual start and end of each elevation, showing it ended within the approved window and the tier's maximum.
  • Each out-of-hours phone approval, recorded on the ticket within 1 working day by the pack's default.
  • The session review matching every elevation to its ticket's window, system and rights.
  • The exception reference, band and expiry for any departure from the standard.

Assumptions

  • Systems are assigned to the three tiers, and Tier 0 and Tier 1 rights are set up as eligible with the tier's maximum configured, or removed by a scheduled task.
  • The approver roles exist, or you have mapped them to your own: Head of IT, Head of Information Security, system owners, IT Operations Manager, and an on-call approver list that never includes the requester.
  • The 4-hour and 8-hour maximums and the 1-working-day limit for recording a phone approval are the CISO Times privileged access pack's defaults. Your own standard may set shorter ones; the pack advises against longer maximums.

Not covered here