Blast radius, standing privilege, and credential rotation

The Analog Informatics Corporation (AIC) AIC Enterprise Privilege Suite™ finds every place a privileged account is used, reports how far a compromise would reach, and shows which memberships grant administrator rights that stay in place with no request. From that picture you rotate the credential now or on a schedule, and you replace standing administrator membership with elevation that a person requests and an approver grants for a set time.

This work is available now as part of Privileged Identity Management in AIC Enterprise Privilege Suite™. Elevation on request is available now through Privileged User Management. See Privileged Identity Management and Privileged User Management.

Short answers

What is the blast radius of a credential? Every host and service that uses it. A domain account that runs services on 40 servers has a blast radius of 40 servers. The suite lists the Windows services, scheduled tasks, IIS application pools, COM+ and DCOM applications, and group managed service account hosts for that identity.

Where should an account exist? A domain administrator identity belongs on a domain controller, not as the logon for a service on another system. A service should run as its own service account, not as the local Administrator. One service account should not be the logon on five or more hosts. A person who needs administrator rights for a task should not remain a member of local Administrators after the task ends.

How old is each password? Discovery records when the password was last set. A local administrator password older than 90 days is a finding. The password-age report lists accounts oldest first and counts how many administrator passwords are past that age.

Which group memberships should not exist? Membership that grants administrator rights with no expiry and no approval. The suite audits local Administrators on every discovered host and flags members other than the local Administrator account and Domain Admins. Those extra members are standing privilege.

What replaces that membership? Take the account out of the group. When the person needs the rights, they request elevation, an approver grants it for a set time, and the suite removes the rights when the time ends. See Privileged User Management and What are zero standing privileges.

Can rotation run now and on a schedule? Yes. Run a password change immediately, or put the same password-change job on a schedule. Either way the suite changes the credential and updates every dependency. A preview shows the plan first.

What reports are available? Discovered systems and accounts, password age, privileged group membership, blast radius per identity, findings, and a before-and-after comparison of a change. Export the inventory report as comma-separated values or JSON.

Where accounts should exist

Discovered Accounts list of operating system accounts on Linux and Windows workstations with platform, privilege level, local groups, and managed status, plus Create job and Apply workstation template actions. — Discovered Accounts shows each account's system, privilege level, local groups, and managed status.

Placement	What the suite reports	Availability
Domain administrator used as a service on a system that is not a domain controller	Move the service to a least-privilege domain account, or to one managed service account per host	Available now
Service running as the local Administrator	Use a dedicated service account	Available now
One service account on five or more hosts	Split it into one managed service account per host. A preview shows the plan first	Available now
Extra members of the local Administrators group	Members other than the local Administrator account and Domain Admins	Available now

Password age

Report	Availability
When each discovered account's password was last set, and the age in days	Available now
Local administrator password older than 90 days	Available now
Accounts listed oldest first, with a count of administrator passwords past that age	Available now

Standing privilege and elevation on demand

Token Elevation page for minting one-time elevation codes that an endpoint agent redeems, and for remote non-agent local elevation with start delay and duration. — Token Elevation provides one-time elevation codes and remote local elevation with a defined start delay and duration.

A standing privilege is a group membership or a password that remains after the work is done. Local Administrators and Domain Admins are the usual places it hides.

Step	What happens	Availability
Find the membership	The group audit lists every member of a privileged group and the host where that membership was found	Available now
Flag members that should not stay	Local Administrators members other than the local Administrator account and Domain Admins are a finding	Available now
Replace standing rights with a request	The finding names just-in-time elevation. The person requests elevation. An approver sets the system, the person, the reason, and the time. The suite removes the rights when the time ends	Available now. See Privileged User Management

Removing a person from a privileged group is an action for the account owner. The suite records the finding and the recommendation. It does not remove the member by itself.

Rotation and remediation

Action	Availability
Rotate a credential immediately and push the new value to every place that uses it	Available now
Run the same password change on a schedule	Available now
Preview the full plan before anything changes	Available now
Generate a remediation plan for every finding the product can fix	Available now as a plan. Applying every plan in one action is planned
Compare inventory before and after a change	Available now

Some findings need information technology action rather than a product change. The suite flags those so the owner can see them.

Reports

Report	What it contains	Availability
Inventory	Discovered systems, accounts, and where each credential is used. Filter by credential risk	Available now
Password age	Every account, oldest first, with administrator passwords called out	Available now
Group membership	Members of a named privileged group, and the host each membership came from	Available now
Blast radius	Hosts and services one identity reaches	Available now
Findings	Each rule result, its severity, and whether a remediation plan exists	Available now
Before and after	Two inventory snapshots compared, including the snapshots taken around a change	Available now
Export	Inventory as comma-separated values or JSON	Available now

For more information about Analog Informatics Corporation, please go to analoginfo.com.