UC Berkeley security policy mandates compliance with Minimum Security Standard for Electronic Information for devices handling covered data. The recommendations below are provided as optional guidance for controlled use of administrative privileges requirements.
Requirement
Administrative credentials must be used only on devices that have been configured according to the Secure Device Configurations control.
Description of Risk
Attackers make unauthorized use of administrative privileges to discover and compromise covered data. High risk activities increase the likelihood of introducing malicious code that takes advantage of unpatched vulnerabilities.
Recommendations
Administrative credentials are system user accounts that are authorized to perform system and security related functions that ordinary users are not authorized to perform. Examples of system and security related functions include starting/stopping application services, creating/updating other user accounts, etc. If administrative credentials are loosely and widely used in less secured devices, an attacker is more able to compromise and gain full control of these less secured devices. As a result, the attacker may now have more avenues to gain access to administrative privileges.
Administrative credentials should be used only on devices that are configured and secured according to MSSEI requirements. Examples of non-compliant devices include public terminals, family and friend’s laptops, etc.