Privileged Access Workstations (PAW): administering Active Directory from a clean source
An administrative account is never more secure than the machine it is used from. Strong passwords, multifactor authentication and silos are useless if the administrator's device is compromised: the attacker sees what they type and acts within their sessions. The privileged access workstation applies the clean source principle.
The clean source principle
Any system that controls another system must be at least as secure as it. A domain controller administered from an office workstation inherits that workstation's security level: web browsing, email, attachments, user-installed software, USB devices. One successful phish on that device is enough for the attacker to wait for the next administration session.
Separating accounts (one office account, one admin account) is necessary but not sufficient: if both are used on the same machine, an attacker on it captures both. It is the machine itself that needs separating.
What a PAW is
A privileged access workstation is a machine reserved for administrative tasks of a given tier. Its usual characteristics:
- a recent operating system, installed from trusted media and hardened against a security baseline;
- no email and no general internet browsing, outbound traffic limited to the required administrative destinations;
- application control (App Control for Business or AppLocker) allowing only approved tools;
- Credential Guard, LSA protection, BitLocker and Secure Boot enabled;
- no local administrator rights for the user;
- management, updates and monitoring provided by systems of the same tier as the PAW.
For Tier 0, the PAW is itself a Tier 0 asset: it belongs to the corresponding authentication silo, and so do its management tools.
Possible architectures
| Model | Principle | Consideration |
|---|---|---|
| Two devices | An office workstation and a physically separate PAW. | Simplest and safest; cost and desk space. |
| PAW host, virtualised office environment | The PAW is the physical machine; the office environment runs in a virtual machine or remote desktop. | Acceptable, because the more secure machine controls the less secure one. |
| Office host, virtualised PAW | An admin VM on the office workstation. | Avoid: a compromised host controls the VM. |
Jump servers or PAWs?
Many organisations believe they are protected because administration goes through a jump server. A jump server brings traceability and a network filtering point, but it does not solve the source question: if the administrator connects to it from a compromised office workstation, the attacker captures the session or credentials upstream. The jump server also becomes an asset of the highest tier it can administer, and must be protected as such.
The right model combines both: a PAW as the starting point, possibly a jump server for specific uses, never a jump server on its own.
Start with Tier 0. There is no need to equip the whole IT department on day one. A few PAWs for domain, certificate infrastructure and hybrid synchronisation administrators cover the highest risk. Tiers 1 and 2 can follow.
Getting PAWs adopted
PAWs most often fail for usability reasons: missing tools, painful file transfers, no on-call procedure. Plan a list of approved tools, a controlled file transfer mechanism, a remote working solution and a spare device. Add technical measures that make bypassing impossible: per-tier logon restrictions and an authentication silo limiting Tier 0 accounts to PAWs. Microsoft describes these principles in its enterprise access model; check its current documentation for how they fit with cloud services.
What an audit checks
- the machines Tier 0 accounts actually authenticate from;
- PAW hardening: application control, internet access, local rights, credential protections;
- the PAW management chain and its tier;
- the role of jump servers and the devices that connect to them;
- technical restrictions preventing administration from other machines.