Privileged by design: The attack paths you already built

Recent cyber security incidents continue to demonstrate that widely adopted technical controls — such as multi-factor authentication (MFA) and endpoint detection and response (EDR) — are necessary but not sufficient to prevent systemic compromise by determined adversaries. In many cases, threat actors do not rely solely on technical exploits; instead, they target administrative practices, identity workflows, and operational dependencies to establish persistence, move laterally, escalate privileges, and ultimately achieve objectives such as data exfiltration or ransomware deployment.

This session will examine five recurring weaknesses observed across compromised environments that are frequently overlooked in defensive design and day-to-day operational practice. These weaknesses often arise not from the absence of security technologies, but from implicit trust assumptions, over-privileged accounts, fragmented administrative processes, and insufficient alignment between security controls and real-world adversary behaviours.

First, the session will explore how attackers increasingly target enterprise security and management tooling to extend their control within an environment. Tools deployed for endpoint management or threat detection can be misused where role-based access control (RBAC) is overly permissive or administrative roles are broadly assigned. When improperly governed, these platforms may enable attackers to execute scripts, enforce configuration changes, or otherwise manipulate large portions of an enterprise estate.

Second, the presentation will discuss pathways to privilege escalation that stem from human and procedural vulnerabilities, including service desk workflows, VIP support processes, and legacy administrative entitlements. Threat actors routinely exploit publicly available identity information relating to IT personnel to conduct social engineering or spear phishing attacks, in some cases leveraging routine support interactions to gain elevated access. While education and awareness training remain essential, additional technical controls are required to limit the impact of human error, particularly for privileged accounts.

Third, the resilience of backup and recovery strategies will be discussed in the context of attacker capabilities. When improperly secured adversaries are able to locate, access, or manipulate backup repositories, and thereby undermine recovery objectives.

Fourth, the concept of Tier 0 infrastructure will be expanded beyond domain controllers and global administrators to include management agents, hypervisors, delegated application permissions, and third-party access arrangements. Implicit administrative control over critical systems — often retained for operational convenience — can introduce unintended attack paths across both on-premises and cloud environments. 

Finally, the risks associated with conducting administrative tasks from user-facing workstations will be examined. Devices that simultaneously support web browsing, email access, and privileged sessions may serve as intermediary platforms for credential theft or session hijacking, thereby facilitating lateral movement by adversaries.

For each of the five vectors presented, potential mitigations will be outlined, with emphasis on reducing implicit privilege, strengthening operational boundaries, and aligning administrative practices with least privilege principles. Attendees will gain insight into how threat actors adapt to defensive controls and will be equipped to assess their own environments for structural weaknesses that may otherwise enable compromise.