<\/span><\/h2>\n\n\n\nIf you’re actively being affected by a privilege escalation attack, or suspect that you might be, take the following steps, including notifying your team, changing key credentials, disabling accounts, and checking for malware. Even if it’s a false alarm, practicing this process is still a good procedure to ensure your team is prepared for a real attack.<\/p>\n\n\n\n
Notify All Relevant Team Members<\/h3>\n\n\n\n
All IT and security administrators should immediately be alerted about the attack, even if it’s just a suspected breach or a notification from your company networking monitoring or endpoint detection platform. Even a suspicion should be reported \u2014 privilege escalation can result in major damage to the company.<\/p>\n\n\n\n
Change Any Compromised Credentials<\/h3>\n\n\n\n
If you’re able to identify which account has been compromised, immediately change the credentials to that account. This might just be the password, or it could be both the password and username.<\/p>\n\n\n\n
Shut Down Accounts<\/h3>\n\n\n\n
You may need to go farther than changing credentials and actually disable the affected application instance. While this may not mean shutting down the entire application, it could require shutting down an administrator account for a period of time. The threat actor is then unable to perform administrative actions.<\/p>\n\n\n\n
Scan for Malware<\/h3>\n\n\n\n
A threat actor may have downloaded malware in multiple locations within the computer system. It may still be running in certain programs, giving them continued access to the system even if the account they’ve compromised is now shut down. You’ll want to look for any further traces of the attacker in your network.<\/p>\n\n\n\n
<\/span>Bottom Line: Privilege Escalation Attacks<\/span><\/h2>\n\n\n\nFending off privilege escalation attempts requires IT teams to be very clever and very aware of their networks, systems, and applications. All backdoors should be accounted for and patched; all passwords should be strengthened and regularly updated.<\/p>\n\n\n\n
While these measures aren’t always enough to prevent attacks, they’ll go a long way in reducing the easy inroads that threat actors currently have. Making attackers’ jobs more difficult doesn’t eliminate privilege escalation attacks, but it sets a baseline for IT and security teams and prepares them to take more advanced strides to preventing breaches. Don’t forget to communicate heavily with not only your direct teams, but also the entire company \u2014 they should know the risks they face, and should assist IT and security departments by recognizing and avoiding phishing attempts.<\/p>\n\n\n\n
Is your business working to protect privileged accounts and sensitive data? Read about privileged access management software<\/a> next.<\/strong><\/p>\n\n\n