Who Can Become Root? An SRE Guide to Access Drift and Privilege Escalation
Privilege escalation is not always a dramatic exploit, and in production systems it is often less about one clever trick than about a chain of ordinary operational decisions that were each made for a sensible reason, at a stressful moment, and without anyone stepping back later to ask what those decisions allowed when combined.
This blue-team SRE talk asks a simple but uncomfortable question: who can become root?
We will look at how temporary access, old service accounts, broad deploy permissions, and emergency exceptions can accumulate into hidden access paths that make people, processes, pipelines, or services more powerful than intended. Through a local, isolated demo, we will follow one flawed access path from a boring starting point to an uncomfortable ending, then reverse the story from the defender’s side to ask what evidence, containment, and guardrails would have exposed it earlier.
Attendees will leave with a practical access-path review worksheet they can use to move beyond asking "who has admin?" and start asking the more useful question: "who can become admin?"
In production environments, access control rarely fails in one clean, obvious moment. It usually drifts. A permission is added during an incident because the system needs fixing now, a service account keeps working long after its original purpose has changed, or a deploy role slowly becomes powerful enough to cross boundaries that nobody meant it to cross. Each decision may be defensible on its own, but when those decisions accumulate, the real risk is no longer only who has admin today, but who can become admin tomorrow.
This talk looks at privilege escalation from a blue-team SRE perspective, focusing not on exploit showmanship, but on the quiet routes through which a person, process, pipeline, or service account can become more powerful than intended because the system remembers every exception long after the humans have forgotten why it was approved.
The session follows one access path from a boring operational starting point to an uncomfortable ending, moving through the kinds of trust boundaries that SREs deal with in real production environments and showing how risk often lives not inside one obviously dangerous permission, but in the way permissions compose across services, workflows, and emergency fixes.
The demo is local, isolated, and deliberately flawed. First, we will watch ordinary access become too much access. Then we will reverse the story from the defender’s side and ask what an SRE would need to check, what evidence would prove the path existed, what should be contained immediately, and what has to change so the same path cannot quietly return.
After the demo, we will connect the same pattern to cloud and platform environments, where role assumption, service accounts, audit trails, and policy analysis can either expose the truth or hide it behind a false sense of control.
This is a defensive SRE talk about making privilege paths visible before an attacker, accident, or emergency workaround finds them first.
Viola Lykova is a senior software engineer and SRE focused on authentication reliability, access control, and production security. She is an experienced speaker and panelist who has presented across security, testing, cloud, and DevSecOps communities, including Cypress, Community Stack, AWS user groups, Ministry of Testing London, London DevSecOps, and IOActive Hack Soho.
She is an AWS Community Builder in the Security category and a Cypress Ambassador. Outside of her day-to-day engineering work, Viola runs weekly hands-on open-source workshops with contributors through Snappycart, volunteers with Code Your Future, and creates educational content on software engineering, reliability, and security.