https://www.sans.org/reading-room/whitepapers/critical/implementing-critical-security-control-controlled-administrative-privileges-37115