What is the difference between vertical and horizontal privilege escalation?

What is the difference between vertical and horizontal privilege escalation?

In a vertical privilege escalation attack, the attacker moves up the privilege ladder, so to speak, by granting himself privileges usually reserved for higher-access users. In horizontal privilege escalation, the attacker is a normal, low-end user who accesses the information of other normal users.

Which of the following is an example of an elevation of privilege issue?

Vertical privilege escalation (aka elevation of privilege or EoP) — Here, a malicious user gains access to a lower-level account and uses it to gain higher level privileges. For example, a hacker might compromise a user’s internet bank account user and then try to get access to site administrative functions.

What is horizontal and vertical escalation?

Horizontal escalation is a direct contrast to vertical escalation which employs types of weapons not previously used in the conflict. That type of escalation also allows attacking new types of targets in order to have an upper hand to the other combatant.

What are the guidelines for a privileged account?

The recommendations below are provided as optional guidance to assist with achieving the Privileged Accounts requirement. Devices must be configured with separate accounts for privileged (administrator) and non-privileged (user) access. Non-privileged user accounts must be used and only elevated to root or Administrator when necessary.

What happens when a user is a privileged user?

When reading email, browsing the web, or accessing files as a privileged user, any malware a user encounters will also run as a privileged user, bypassing all access and security controls.

What are some examples of roles and privileges?

For example, you can grant the privileges to select, insert, update, and delete records from the employees table to the role named clerk, which in turn you can grant to users scott and brian. Because roles allow for easier and better management of privileges, you should normally grant privileges to roles and not to specific users.

How is excessive granting of privileges a problem?

Excessive granting of unnecessary privileges can compromise security. A user can receive a privilege in two different ways: You can grant privileges to users explicitly. For example, you can explicitly grant to user SCOTT the privilege to insert records into the employees table.