Anytime hackers are trying to access information that is way out of their reach on your information system, they will likely make use of an escalation of privileges to make it appear to the system like they are the administrators. They do this to access information and gain permissions that are only accorded to the genuine and authentic users of the information system.
As a security-aware administrator, you must understand what a privilege escalation is and exactly how it happens to ensure that you know what measures to apply on your current systems to alert you in case of such an attack as well as the kind of risks that this kind of hacking approach holds for your information. The way an escalation takes place starts with the hacker accessing a basic account that has limited permissions to access the system.
Usually, these low-level accounts are not as well secured as the higher-level accounts and the hacker will have quite an easy time gaining access into the less secure account. The hacker will also be able to hack the low-level account much easier when the passwords are simple to break and they will spend less time hacking such an account.
However, once the hacker has accessed the low-level account and hacked into it, the trouble begins for the higher level accounts as the hacker only needs to perform the actual escalation of privileges and get to have access over the entire information system.
The information system is now at risk owing to the current knowledge that the hacker possesses in connection with the system and from the low-level account, they can become super administrators and steal information or even reset the entire system to force some information to be deleted from the account and cause the system to accept new accounts.
In some scenarios, the hacker will make use of their escalation of privileges to create new accounts which can be sued to later access the system and appear like one of the active users of the information systems. This is quite risky for modern information systems which require securing to avoid the escalation of privileges attacks which make it possible for the hacker to have a greater reach into the information and the applications and features of an information system that are only accessible to the users that have special permissions.
The other reason for securing your system is to ensure that the hacker does not get to hack into low-level accounts and any access attempt into the high-level accounts is logged for tracking purposes.
Modern information systems are also constantly monitored and any suspicious login activity such as one that happens at odd hours triggers an alarm. In other scenarios, the user can also avoid the escalation of privileges by keeping out the low-level users and the high-level users on a separate system which ensures that the information does not collide or even get to be stored in a central location where it can be easily accessed from broken into accounts.
