BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Auditing Privileged Access on Windows

Posted March 20, 2014    Morey Haber

When a user is given privileged access to a Windows host, they gain access to a wide variety of tools to control the system. Everything from the GUI and Start Menu to PowerShell and command line allow system alteration and software installation. In truly secure world, no end users would have administrative privileges. However, we know that going down that impractical road leads to Help Desk nightmares and major productivity hits.

So, if your organization is like most, it keeps a log of who has administrative access (right?). That’s great, but knowing who has keys to the kingdom is only half the battle. Keeping Windows systems secure and compliant in environments where users require elevated privileges necessitates maintaining visibility into what they’re doing with those privileges.

This is where PowerBroker for Windows (PBW) can help. The solution provides least-privileged access to Microsoft Windows desktops and servers using a patent-pending technology to manage the security tokens for the application (not the user) at runtime. PBW includes several key features that deliver a complete perspective of all changes to a host when privileges have been granted:

  • Session Monitoring (SM) – Advanced screen capturing, keystroke logging, and mouse-click recording of a privileged session for the duration of access. Results are encrypted and sent to the BeyondInsight IT Risk Management Console for later searching, reporting, forensics, download, and DVR-style playback.
  • File Integrity Monitoring (FIM) – The monitoring, logging, and even denial of access to the file system based on users, to ensure privileged access does not alter the file system in an undesirable way. FIM is a persistent function within PBW and operates even when no user is interactively logged in. The results are also sent to the BeyondInsight IT Risk Management Platform console for alerting and reporting.
  • Event Log Monitoring (ELM) – As users interact with a host, critical functions like services and drivers generally write to the Windows Event Log. PBW contains pattern-based Windows Event Log Monitoring and reporting to track all types of access (privileged and non-privileged). As a privileged user, it is possible to create local users or even disable security tools if PBW rules were written to do so. ELM allows for the logging of these activities and provides a deeper view into system interaction.
  • Risk Compliance – The decision to elevate an application via rule can have some shortcomings if the application possesses an unnecessary risk based on vulnerabilities. Risk Compliance is a part of Vulnerability-Based Application Management (VBAM), which allows rules to be created for privileged access based on an application’s published vulnerabilities. This allows auditing of applications based on their risk, regulatory compliance violations, and permissions all through BeyondInsight to determine the health of applications when given administrative privileges. It completes the auditing perspective because you not only can track what privileged users do with complete context, but also audit the applications themselves to round out the documentation trail.

beyondtrust-dashboard-auditingprivaccessblog

PowerBroker for Windows provides much more than privileged identity management and application control alone. The auditing capabilities in PBW and BeyondInsight allow for the complete logging of privileged user activity as required by security best practices and regulatory compliance initiatives. In addition, these features can replace many standalone tools for file integrity monitoring and Windows Event Log monitoring – all the way down to the desktop or server. They help support the auditing of least-privilege access and allow your organization to realize the cost and operational benefits of least-privilege access.

For more information, check out:

Tags:
, , , , , , , ,

Leave a Reply

Additional articles

webinar_ondemand

On Demand Webinar – Why You Still Suck at Patching

Posted March 27, 2015    Lindsay Marsh

On Demand Webinar: Dave Shackleford recounts some of his personal experiences in patch management failure, and breaks down the most critical issues holding many teams back from patching more effectively.

Tags:
,
dave-shackleford-headshot

Why You Still Suck at Patching…and How to Turn Your Life Around

Posted March 25, 2015    Dave Shackleford

Live webinar | March 26, 2015 | 10am PT/1pm ET | Dave Shackleford, SANS Instructor | Why You Still Suck at Patching…and How to Turn Your Life Around

Tags:
, ,
infographic

Privilege Gone Wild 2: Over 25% of Organizations Have No Privileged Access Controls

Posted March 24, 2015    Scott Lang

BeyondTrust recently conducted a survey, with over 700 respondents, to explore how organizations view the risk of misuse from privileged account misuse, as well as trends in addressing and mitigating those risks.

Tags:
,