Excessive Standing Privilege

What this finding is

Identities carry broad, always-active privilege that is not required for their routine work — wildcard IAM policies, permanent membership of highly-privileged directory groups, or developer accounts with unrestricted production access. The distinguishing feature is that the privilege is *standing*: available at every moment rather than granted on request for a bounded window.

Why it is Tier 1

Standing privilege sets the blast radius of every other compromise. Phishing a developer who holds permanent production administrator rights is equivalent to phishing an administrator, and the attacker inherits the full permission set instantly. Because this finding multiplies the impact of every credential-theft technique, it is treated as Tier 1 even though it is a configuration state rather than an exploitable defect.

How to detect it

1. 1Compare granted permissions against permissions actually exercised — cloud providers expose this directly (AWS IAM Access Analyzer, Azure Entra Permissions Management, GCP Recommender).
2. 2Search IAM policy documents for wildcard actions and wildcard resources, and for AdministratorAccess or Owner attached to human identities.
3. 3Enumerate membership of Domain Admins, Enterprise Admins, Global Administrators, and equivalent, and confirm each member against a named business justification.
4. 4Identify privilege inherited through nested group membership, which routinely grants access no one intended and no one reviews.

How to remediate it

Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.

1. 1Right-size the highest-privilege identities first, using observed usage as the baseline for the replacement policy.
2. 2Replace standing administrative access with just-in-time elevation — time-bounded, approved, and logged.
3. 3Separate duties so that the identity which approves an elevation cannot also request it.
4. 4Attach permission boundaries or service control policies so that even a compromised administrative role cannot exceed an outer limit.
5. 5Establish a recurring review, and treat any role that has gone unused for a defined period as a candidate for automatic removal.

How to verify the fix

Mappings

Other Tier 1 findings in Identity & Access Management