2 cissp ® Official Study Guide Eighth Edition

Dual Administrator Accounts 
Many organizations require administrators to maintain two accounts. They use one 
account for regular day-to-day use. A second account has additional privileges and 
they use it for administrative work. This reduces the risk associated with this privileged 
account. 
For example, if malware infects a system while a user is logged on, the malware can 
often assume the privileges of the user’s account. If the user is logged on with a privileged 
account, the malware starts with these elevated privileges. However, if an administra-
tor uses the administrator account only 10 percent of the time to perform administra-
tive actions, this reduces the potential risk of an infection occurring at the same time the 
administrator is logged on with an administrator account. 
Auditing can verify that administrators are using the privileged account appropriately. 
For example, an organization may estimate that administrators will need to use a privileged 
account only about 10 percent of the time during a typical day and should use their regular 
account the rest of the time. An analysis of logs can show whether this is an accurate esti-
mate and whether administrators are following the rule. If an administrator is constantly 
using the administrator account and rarely using the regular user account, an audit can fl ag 
this as an obvious policy violation.
Security Audits and Reviews 
Security audits and reviews help ensure that an organization has implemented security 
controls properly. Access review audits (presented earlier in this chapter) assess the effec-
tiveness of access controls. These reviews ensure that accounts are managed appropriately, 
don’t have excessive privileges, and are disabled or deleted when required. In the context of 
the Security Operations domain, security audits help ensure that management controls are 
in place. The following list includes some common items to check: