administrative privilege
A class of access rights — elevated above those granted to standard users — that collectively authorize an account or identity to perform security-sensitive operations that affect the configuration, integrity, or management of a system or network. What distinguishes it from ordinary user permissions is the authority to modify or override other accounts' rights and to perform security-relevant functions — such as key management, account management, network and system administration, and database administration — that ordinary users are not authorized to perform. In practice, the field uses the term to identify a condition that triggers heightened governance: users or accounts requiring administrative privileges on system accounts receive additional scrutiny from organizational personnel — such as the system owner, mission/business owner, or chief information security officer — responsible for approving such accounts and privileged access. Control frameworks invoke it primarily to enforce least-privilege goals: limiting how many accounts carry such privileges reduces the probability of a threat actor abusing them to cause harm.
Senses
No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.
A level of access permission granted to an account that authorizes the holder to perform control, configuration, and administration functions on a system — such as installing software, modifying security settings, managing other accounts, or altering system behavior — that are withheld from standard users. Users who require administrative privileges on system accounts receive additional scrutiny by personnel responsible for approving such accounts and privileged access. Because IT personnel with administrative privileges can affect the security posture of an entire system, the field treats the expression as an authorization category subject to least-privilege controls, heightened authentication requirements, and continuous monitoring; administrative privileges are often required for malware to execute, making their governance a primary attack-surface concern. Users requiring administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible for approving such accounts and privileged access, including system owner, mission or business owner, senior agency information security officer, or senior agency official for privacy.
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- administrative privileges
- possessive
- administrative privilege's
- pluralpossessive
- administrative privileges'