BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Auditing Privileged Access on Windows

Posted March 20, 2014    Morey Haber

When a user is given privileged access to a Windows host, they gain access to a wide variety of tools to control the system. Everything from the GUI and Start Menu to PowerShell and command line allow system alteration and software installation. In truly secure world, no end users would have administrative privileges. However, we know that going down that impractical road leads to Help Desk nightmares and major productivity hits.

So, if your organization is like most, it keeps a log of who has administrative access (right?). That’s great, but knowing who has keys to the kingdom is only half the battle. Keeping Windows systems secure and compliant in environments where users require elevated privileges necessitates maintaining visibility into what they’re doing with those privileges.

This is where PowerBroker for Windows (PBW) can help. The solution provides least-privileged access to Microsoft Windows desktops and servers using a patent-pending technology to manage the security tokens for the application (not the user) at runtime. PBW includes several key features that deliver a complete perspective of all changes to a host when privileges have been granted:

  • Session Monitoring (SM) – Advanced screen capturing, keystroke logging, and mouse-click recording of a privileged session for the duration of access. Results are encrypted and sent to the BeyondInsight IT Risk Management Console for later searching, reporting, forensics, download, and DVR-style playback.
  • File Integrity Monitoring (FIM) – The monitoring, logging, and even denial of access to the file system based on users, to ensure privileged access does not alter the file system in an undesirable way. FIM is a persistent function within PBW and operates even when no user is interactively logged in. The results are also sent to the BeyondInsight IT Risk Management Platform console for alerting and reporting.
  • Event Log Monitoring (ELM) – As users interact with a host, critical functions like services and drivers generally write to the Windows Event Log. PBW contains pattern-based Windows Event Log Monitoring and reporting to track all types of access (privileged and non-privileged). As a privileged user, it is possible to create local users or even disable security tools if PBW rules were written to do so. ELM allows for the logging of these activities and provides a deeper view into system interaction.
  • Risk Compliance – The decision to elevate an application via rule can have some shortcomings if the application possesses an unnecessary risk based on vulnerabilities. Risk Compliance is a part of Vulnerability-Based Application Management (VBAM), which allows rules to be created for privileged access based on an application’s published vulnerabilities. This allows auditing of applications based on their risk, regulatory compliance violations, and permissions all through BeyondInsight to determine the health of applications when given administrative privileges. It completes the auditing perspective because you not only can track what privileged users do with complete context, but also audit the applications themselves to round out the documentation trail.

beyondtrust-dashboard-auditingprivaccessblog

PowerBroker for Windows provides much more than privileged identity management and application control alone. The auditing capabilities in PBW and BeyondInsight allow for the complete logging of privileged user activity as required by security best practices and regulatory compliance initiatives. In addition, these features can replace many standalone tools for file integrity monitoring and Windows Event Log monitoring – all the way down to the desktop or server. They help support the auditing of least-privilege access and allow your organization to realize the cost and operational benefits of least-privilege access.

For more information, check out:

Tags:
, , , , , , , ,

Leave a Reply

Additional articles

red-thumbprint

Why big data breaches won’t always be so easy

Posted September 19, 2014    Byron Acohido

This blog post is republished with the permission of ThirdCertainty. See the original post here. – By: Byron Acohido, Editor-In-Chief, ThirdCertainty Some day, perhaps fairly soon, it will be much more difficult for data thieves to pull off capers like the headline-grabbing hacks of Home Depot and Target. That’s not a pipe dream. It’s the projected outcome…

Tags:
, , , , ,
pbps-blog2

8 Reasons Your Privileged Password Management Solution Will Fail

Posted September 18, 2014    Chris Burd

Leveraging complex, frequently updated passwords is a basic security best practice for protecting privileged accounts in your organization. But if passwords are such a no-brainer, why do two out of three data breaches tie back to poor password management? The fact is that not all privileged password management strategies are created equal, so it’s critical…

Tags:
, , , , , ,
pbps-customer-campaign-image

You Change Your Oil Regularly; Why Not Your Passwords?

Posted September 11, 2014    Chris Burd

There are many things in life that get changed regularly:  your car oil, toothbrush and hopefully, your bed sheets.  It’s rare that you give these things much thought – even when you forget to change them. But what if you’re forgetting something that can cost you millions of dollars if left unchanged for long periods…

Tags:
, , ,