Impact Summary: Highly Important to SMBs and MSPs

Shared credentials are a critical security risk to any organization. Prior to GDAP, many businesses would share the default domain administrator account with all engineers.  This led to unnecessary risks from unidentified critical changes that could not be tracked back to a single admin.  It also led to exposures when employees left the company since changing the passwords on these accounts was often skipped over.

For MSPs, it was sometimes worse.  In security minded MSPs, each company enjoyed its own default domain administrator account.  And yet, sometimes those passwords were predictable if unique amongst companies.  The worst MSPs might use the same domain admin password on all client accounts.  One simple breach in one account could domino into multiple other accounts.  It’s been a challenge and and time consuming to address across the IT industry for 2+ decades. 

GDAP Conclusions

GDAP enhances simplicity, supportability, and accountability to administering information technology systems, servers, and networks.  It should be adopted by all IT organizations.

Having fine-grain control over critical administrative privileges is an enormous benefit.  Providing entitlements to perform specific services to engineers without giving the master password to control everything (a Break Glass account), seriously improves security. 

GDAP can still be poorly setup up, so make sure to ask your MSP what their process and policy is around its adoption.  Work together to define an acceptable amount of risk for your organization.  You’ll be very happy you did the work upfront, as the benefits will last a long, long time.