OPINION: Why “least privilege” is Canada’s best defence

Canadian businesses are rethinking their cybersecurity approach by embracing “least privilege” — a model that restricts user access to only what’s necessary, minimizing damage if systems are breached. PHOTO: GETTY IMAGES

Article content

 Microsoft just hit a record high of 1,360 reported vulnerabilities in its software last year. While that number might sound scary, it’s part of a trend we’ve seen for years. The real problem lies in what’s behind the numbers and what they mean for Canadian businesses trying to stay secure in a fast-moving world. 
 
As BeyondTrust’s latest Microsoft Vulnerabilities Report reveals, one type of security risk is especially alarming: elevation of privilege (EoP). This category made up 40 per cent of Microsoft’s total reported vulnerabilities in 2024. That’s not just a statistic; it’s a wake-up call.   

Article content

Article content

What’s elevation of privilege and why should Canadians care? 
 
Imagine someone finds a way to break into your office using a stolen key card. That’s what an elevation of privilege attack is like in the digital world. Once inside, hackers can quietly move through your systems, taking control of sensitive data or expanding their access without being noticed. 
 
These attacks often begin with compromised credentials, sometimes even from non-human identities like service accounts. The problem snowballs from there. We’ve seen it over and over in major data breaches: attackers find one weak point, then jump from system to system. 
 
And Microsoft isn’t the only target. If 40 per cent of their vulnerabilities are EoP-related, imagine how many other software platforms that Canadian companies rely on could also be vulnerable. 
 
The rise of security feature bypass attacks  

Article content

Article content

Article content

Another disturbing trend is the spike in security feature bypass vulnerabilities, up 60 per cent since 2020. These are loopholes hackers use to get around built-in protections in tools like Microsoft Office and Windows. 
 
Think of these bypasses as digital “unlocked doors.” If an attacker finds one, it doesn’t matter how strong your locks are, they’re walking right in. Tools like EDR (endpoint detection and response) are meant to stop threats, but attackers are finding ways around them too. We’ve seen the rise of tools like EDR Killer that are designed specifically to sneak past these defences. 
 
Why Canadian companies can’t rely on just one layer of security  

Article content

Article content

Some businesses still make the mistake of thinking one product or platform will keep them safe. But cybersecurity isn’t about one silver bullet. It’s about layered defences, also known as “defence in depth.” 
 
For example, if a patch causes problems or breaks other tools, companies might delay applying it. But that delay gives attackers a window of opportunity. The better approach? Have multiple layers of protection in place, especially for front-line systems and high-risk assets. 
 
Microsoft Edge: The new problem child?  

Article content

One surprise in this year’s report was the jump in Microsoft Edge vulnerabilities. Critical issues rose from 1 to 9 and total vulnerabilities increased from 249 to 292. Has Microsoft shifted its focus too much toward Azure and Dynamics 365? It’s a question worth asking, especially when everyday tools like browsers are often the first entry point for cyberattacks. 
 
AI brings new benefits and new risks  

Article content

Artificial Intelligence (AI) is transforming how businesses operate, but it’s also opening the door to new threats. Microsoft Copilot Studio and Azure Health Bot, for instance, were flagged for AI-related vulnerabilities in this year’s report. 
 
AI is already being used by threat actors to automate attacks, identify weaknesses faster and even write malicious code. We haven’t yet seen a large-scale attack where an AI or large language model (LLM) becomes the main infection point, but that day is coming. 
 
The biggest question on the horizon: can we trust the output from AI tools? What if the answers, code or insights we get from AI are secretly manipulated by a hacker? Canadian companies need to think about how to secure not just their AI tools, but also the data and systems that feed them. AI security can’t be an afterthought; it must be built into every layer of your defence strategy. 
 
The power of “least privilege” in a “zero-trust” world