Skip to content
draft security v0.1.1 Created 2026-05-18 · Updated 2026-07-24

Privileged User Security Posture Migration

Objective

Bring all engineers with privileged access to other systems into a consistent, auditable security posture — managed endpoints, consistent EDR, least-privilege local admin, and zero-trust network access.

Context

A cybersecurity policy change requires a list of local admin exceptions within ~2 weeks. Beyond that immediate deliverable, the current state is inconsistent: CrowdStrike deployment to workstations is uneven, there is no Engineering-managed endpoint management for Mac, SSLVPN is still the primary remote access method, and local admin is granted broadly. This plan consolidates those gaps into a single initiative driven by ET Engineering Directors.

Tools In Use

  • EDR: CrowdStrike (existing Engineering tenant)
  • Network Access: Cloudflare One Client (formerly WARP) with device posture rules, managed via OpenTofu, integrated with EDNA
  • Endpoint Management (Windows): SCCM and/or Intune (existing)
  • Endpoint Management (Mac): Enterprise JAMF exists; Engineering-managed solution TBD
  • Device Posture Checks: OS version, disk encryption, CrowdStrike running, Intune enrollment

Under Evaluation

  • Mac endpoint management approach (dedicated JAMF instance vs. shared enterprise instance with Engineering scope)
  • Local admin elevation tooling for Mac (e.g., Privileges.app, JAMF Connect)
  • Local admin elevation tooling for Windows (JIT mechanism TBD)

Scope

In scope

  • Compile and submit local admin exception list with per-user business justification (immediate)
  • Define local admin policy (who qualifies, elevation mechanism, audit)
  • Enroll all in-scope workstations in CrowdStrike Engineering tenant
  • Enroll all in-scope workstations in Engineering-managed endpoint management
  • Migrate in-scope users from SSLVPN to Cloudflare One (WARP)
  • Define and enforce device posture rules in Cloudflare One
  • Communications plan to affected engineers

Out of scope

  • Non-privileged users / general staff endpoints
  • Server-side CrowdStrike or endpoint management
  • Cloudflare One application onboarding (already mature)
  • Changes to the cybersecurity policy itself

Phasing

Phase 0 — Immediate (next 2 weeks)

  • Audit current local admin grants across in-scope engineers
  • Resolve exception approval authority (Engineering Directors, Security, or both)
  • Categorize each engineer as standing exception (essential to job function) vs. temporary/JIT-eligible
  • Submit local admin exception list to cybersecurity with per-user business justification, named approval authority, and 6-month review cadence — complete
  • Decide Mac endpoint management approach
  • Evaluate JIT elevation tooling for both Mac and Windows

Phase 1 — Endpoint Enrollment & EDR

  • Enroll all in-scope workstations in chosen endpoint management
  • Ensure consistent CrowdStrike deployment across all in-scope workstations
  • Communicate expectations to engineers (Slack)

Phase 2 — Local Admin Restriction

  • Publish local admin policy
  • Publish self-service FAQ and documentation (how to request elevation, common workflows without admin, on-call scenarios)
  • Remove blanket local admin; apply elevation mechanism
  • Grant exceptions per policy

Phase 3 — VPN Migration

  • Recruit pilot users for Cloudflare One (WARP)
  • Identify and add missing access rules
  • Cut over remaining in-scope users
  • Disable SSLVPN access for migrated users

Risks

Risk Likelihood Impact Mitigation
Missing Cloudflare access rules block pilot users High Medium Pilot phase with quick-turnaround rule additions
Engineers resist local admin removal Medium Medium Clear policy with documented exception process; JIT elevation tooling
Mac endpoint management tool selection delays enrollment Medium High Time-box decision to Phase 0; fall back to enterprise JAMF if needed
No suitable JIT elevation tool identified Low High Maintain broader exception list as interim while evaluating

Success Criteria

  • 100% of in-scope workstations enrolled in endpoint management and CrowdStrike
  • Local admin exception list submitted on time with per-user justification and named approver
  • Published local admin policy with documented exception/elevation process and 6-month review cadence
  • All in-scope users on Cloudflare One (WARP) with passing device posture checks
  • SSLVPN disabled for migrated users

Open Questions

  • Which remaining Phase 0 items are complete? The exception list was submitted, but the standing of the other Phase 0 deliverables — approval authority resolution, standing vs. JIT categorization, Mac endpoint management decision, and JIT tooling evaluation — is unconfirmed. Status stays draft until they are.
  • What JIT elevation mechanism will be used for Windows?
  • What JIT elevation mechanism will be used for Mac? (Privileges.app, JAMF Connect, other?)
  • Will Engineering get a dedicated JAMF instance or a scoped partition of the enterprise instance?

References

Decisions

Date Decision Rationale

Changelog

Date Status Change
2026-05-18 draft Initial draft
2026-05-19 draft Aligned local admin exception process with Access Control Standard: per-user justification, approval authority as Phase 0 deliverable, standing vs. JIT categorization, 6-month review cadence
2026-07-24 draft Review pass: marked the local admin exception list as submitted; added an open question covering the four unconfirmed Phase 0 deliverables that keep this plan in draft; corrected WARP to its current name, Cloudflare One Client; added References; corrected created to the first changelog date