📖 What is Privilege Escalation?
Privilege Escalation is the act of exploiting a bug, design flaw, or configuration error in an operating system or application to gain elevated access to resources. This can be vertical, gaining admin rights, or horizontal, gaining access to another user's account.
"Distinguish between vertical (user to admin) and horizontal (user to user) escalation; the exam may test this specific nuance."
📚 Certification: CompTIA Cybersecurity Analyst+ (CS0-003)
🔑 What are the Key Concepts of Privilege Escalation?
- ▸ Vertical escalation occurs when an attacker moves from a low-privilege account to a high-privilege account, such as transitioning from a standard user to a root administrator.
- ▸ Horizontal escalation happens when an attacker gains access to another user account with similar privilege levels, allowing them to access different sets of private data.
- ▸ Common vectors include exploiting kernel vulnerabilities, misconfigured SUID/SGID permissions in Linux, or leveraging insecure API endpoints that fail to validate user identity properly.
- ▸ Prevention strategies focus on the Principle of Least Privilege (PoLP), implementing robust patch management, and utilizing Just-In-Time (JIT) administration to limit permanent high-level access.
- ▸ Detection often involves monitoring security logs for unauthorized use of administrative tools, unexpected privilege changes, or unusual account behavior indicative of credential theft.
🎯 How does Privilege Escalation appear on the CS0-003 Exam?
You may be asked to analyze a log file where a standard user account is suddenly executing system-level commands; you must identify this as vertical privilege escalation.
A scenario might describe an attacker accessing a web application and changing a URL parameter to view another customer's profile, requiring you to classify this as horizontal escalation.
Expect questions where you must recommend a mitigation strategy for privilege escalation, such as implementing a Privileged Access Management (PAM) solution or enforcing strict ACLs.
❓ Frequently Asked Questions
How do I distinguish between vertical and horizontal escalation during a forensic analysis?
Check the privilege level of the compromised account versus the target. If the attacker gained administrative rights, it is vertical; if they accessed a peer's account, it is horizontal.
What is the relationship between 'Privilege Creep' and privilege escalation?
Privilege creep occurs when users accumulate permissions over time. This increases the risk of escalation because a compromised account already possesses more access than necessary for its current role.