Should administrators use separate accounts for admin work?

Yes. An administrator who reads e-mail and browses the web with an admin account exposes the keys to everything to every phishing message and malicious website. With a separate admin account, used only for admin tasks and never for e-mail or browsing, a compromised everyday account gets the attacker much less. Go further where you can: require phishing-resistant MFA on admin accounts, use them only from a dedicated admin workstation or a bastion host, give each admin account only the rights for the systems it manages, and disable admin accounts that have not been used for months. This applies to your IT supplier's staff as well. It is identity hygiene that a network tool cannot enforce. It does make monitoring sharper, though: when admin sessions are expected only from one workstation or bastion, NetSenX flags admin protocols used from other hosts as lateral movement, on every plan.

← All 45 questions on Zero trust, identity and segmentationAll topics