Just Enough Admin - Security in a Post-Snowden World
summary
Claims a deployable PowerShell toolkit called Just In Time, Just Enough Admin that turns ad hoc admins into constrained operators by provisioning per-task toolkits on DSC-managed endpoints that run as local run‑as accounts whose passwords reset nightly. It uses PowerShell proxies and no language mode to hide dangerous commands, exposes only vetted cmdlets/parameters, logs pipeline execution to ETW, enforces timeboxed sessions with timers, and integrates with ticketing and MFA ideas so admins can do specific actions without broad credentials.
AI-written summary · about
chapters (9)
- 0:00Introduction to GIA
- 0:58The security problem
- 7:12GIA concepts and goals
- 13:20GIA toolkit architecture
- 20:48Desired State Configuration
- 27:47Command visibility and proxies
- 37:14Advanced security measures
- 41:20Under the hood of GIA
- 54:32Demonstration and closing
related talks
43mSecuring your Environment with Just Enough Administration
41mGetting started with Just Enough Administration (JEA)
29mThe SecDevOpronomicon
40mSecurity That Says “Yes”: Agile Windows Security with PowerShell
50mBeyond the Mcse: Active Directory for the Security Professional
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
41mHow Secure Can You Be?
55mOffensive Azure Security