Infrastructure Security · IS-Q11

Question: Is privileged administrative access to infrastructure systems brokered, monitored, and periodically reviewed?

  1. Objective — Why This Matters
    Administrative privileges are the keys to the kingdom. Brokering and monitoring access prevents insider misuse and ensures accountability.

  2. Maturity Levels (0 – 5)

0 — Unaware
Shared admin passwords; no tracking.
1 — Ad Hoc
Manual approvals; partial logging.
2 — Defined
Named admin accounts; periodic reviews.
3 — Managed
Jump-host or PAM solution deployed; session recording.
4 — Integrated
JIT access, MFA, and SIEM integration.
5 — Optimized
Adaptive privilege analytics with automatic revocation.
  1. How to Level Up
From → To Actions
0 → 1 Prohibit shared credentials; track admin actions manually.
1 → 2 Create named accounts; enforce strong authentication.
2 → 3 Implement PAM or jump host with session logging.
3 → 4 Add JIT elevation and SIEM alerts.
4 → 5 Introduce analytics for privilege anomalies and auto-revocation.

  1. People / Process / Technology Enablers
    People – System Admins, SOC.
    Process – Access review, session monitoring, quarterly certification.
    Technology – Teleport, Vault, Wazuh, Keycloak.

  2. Evidence Required
    Access approval logs, session recordings, certification reports.

  3. Metrics / KPIs
    • number of privileged accounts without assigned owner
    • percentage of sessions recorded and archived
    • average time to revoke inactive admin rights

  4. Low-Cost / Open-Source Options (MSME)

Purpose Tool Notes
PAM / Jump host Teleport Community / Guacamole Broker and record admin sessions.
Access control Keycloak MFA and RBAC for admin logins.
Monitoring Wazuh Alerts on privilege use and anomalies.

  1. Common Pitfalls
    Shared root access; unreviewed exceptions; missing MFA for console sessions.

  2. Compliance Mapping

Standard Clauses / Notes
ISO 27001 A.5.15 / A.5.18.
NIST CSF 2.0 PR.AC-6 / DE.CM-3.
CERT-In 2022 Privileged access governance.
NIRMATA Scoring IS-Q11 ≥ Level 4 requires JIT + MFA integration.