# Privileged access

**How do you secure administrator accounts?**

Privileged access means the accounts that may do everything: administrators, service accounts, the access of your IT provider. Whoever takes one of them over holds the business in their hands.

The first principle is separation. Anyone who reads email and browses the web every day should not do so with an account that carries administrator rights. A separate account for administration, used only for that, prevents one click on an attachment from opening the whole network.

The second principle is limitation. Rights are granted for the duration of the task and withdrawn afterwards. Permanent administrator rights held just in case are convenient and expensive.

The third principle concerns remote maintenance. Your provider's access is privileged access. It belongs behind a second factor, it belongs logged, and it belongs closed as soon as the co-operation ends.

## Related terms
- [Permission model and least privilege](https://vetosec.at/en/it-security/berechtigungskonzept/)
- [Zero trust](https://vetosec.at/en/it-security/zero-trust/)
- [Insider threat](https://vetosec.at/en/it-security/insider-bedrohung/)
- [Monitoring and logging](https://vetosec.at/en/it-security/monitoring-logging/)

## Source
https://vetosec.at/en/it-security/privilegierte-zugaenge/ (vetosec, schutz)