This is a concept website · Enquire about this domain

cloudvps.com.au

# job 02 · admin access and MFA

Admin access and MFA on a VPS you run

ASD calls administrator accounts “a valuable target for malicious actors”, because anyone holding admin access can reshape a system, get around its security controls and reach sensitive data. Its guidance is to give admin access only to the people who need it, through separate administrator accounts, and to protect sign-in with phishing-resistant multi-factor authentication (MFA).

General information, not technical advice for your server. This guide rests on ASD’s Restricting administrative privileges and Implementing multi-factor authentication; the official place to check is cyber.gov.au.

whyWhy the admin login is the prize

ASD calls restricting administrative privileges “one of the most effective mitigation strategies in ensuring the security of systems”. The reason is what restriction takes away from an attacker. Restricting them “makes it more difficult for malicious actors to elevate privileges, spread to other hosts, hide their existence, persist after reboot, obtain sensitive data or resist removal efforts.”

does it countWhat restricts admin access, and what only looks like it

ASD names four approaches that may seem to give the benefits but “do not meet the intent of this mitigation strategy, and in some cases may actually increase the risk to an organisation’s network”. Beside them is the approach it calls correct. Both lists are quoted in ASD’s order.

Does not count

  • “simply minimising the total number of privileged accounts”
  • “implementing shared non-attributable privileged accounts”
  • “temporarily allocating administrative privileges to user accounts”
  • “placing standard user accounts in user groups with administrative privileges.”

The correct approach

  1. “identify tasks which require administrative privileges to be performed”
  2. “validate which staff members are required and authorised to carry out those tasks as part of their duties”
  3. “create separate attributable accounts for staff members with administrative privileges, ensuring that their accounts have the least amount of privileges needed to undertake their duties”
  4. “revalidate staff members’ requirements to have a privileged account on a frequent and regular basis, or when they change duties, leave the organisation or are involved in a cyber security incident.”

On a server several people look after, the second “does not count” item is the one to notice. ASD’s small business handbook says shared accounts “increase security risks and make it harder to track activity”, and the correct approach asks for separate accounts that can be attributed to each person.

ASD adds two protections for the privileged accounts themselves: technical controls that stop them reaching the internet, unless that is needed to manage cloud services and then only as far as the duties require, and system administration carried out in a secure manner. The ISM, September 2026, says “the security of administrative activities can be improved by segregating administrative infrastructure from the wider network and the internet”, and that, in doing so, “a jump server (also known as a jump host or jump box) that allows only necessary ports and services to be used can be an effective way of simplifying and securing administrative activities”.

mfaWhat counts as multi-factor

ASD’s definition is exact. MFA is “a method of authentication that uses two or more authentication factors to authenticate a single claimant to a single authentication verifier”. The factors come from at least two of three kinds: something the person knows, such as a password; something they have, such as a security key; and something they are, such as a fingerprint.

Two set-ups fall short of that definition:

  • A login that can drop to one factor. “If an authentication method at any time offers the ability to reduce the number of authentication factors to a single factor it is by definition no longer a multi-factor authentication method.” ASD’s example is the “remember this computer” option.
  • Several checkpoints in a row. Signing in step by step through separate checkpoints is multi-step authentication, and ASD says it “is not a suitable substitute for multi-factor authentication”.

strengthWhich second factor

All the methods ASD lists beat a password alone, but some are stronger than others. MFA is most effective when one factor uses public key cryptography and sits on a device physically separate from the one being used to sign in, such as a security key. ASD’s key actions favour strong methods, “security keys or certificates”, over weaker options like SMS, and it does not recognise a password plus a biometric as a suitable form of MFA.

ASD’s supplementary measures for security keys, quoted in its order
  • “ensure users do not store security keys with their devices, especially those with NFC capabilities”
  • “ensure users receive a visual notification each time an authentication request is generated that requires them to authenticate using their security key”
  • “use security keys that have been certified to the latest FIDO2 specification”
  • “instruct users to report any lost or missing security keys as soon as practical.”

reviewAccess that expires

Admin access should be reviewed regularly and removed when it is no longer needed, when people change roles, or when they leave. The Essential Eight maturity model puts numbers on that at Maturity Level Two:

  • “Privileged access to systems, applications and data repositories is disabled after 12 months unless revalidated.”
  • “Privileged access to systems and applications is disabled after 45 days of inactivity.”

The same level asks: “Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed.”