BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

BeyondTrust Webcast: “The Privileged Identity Management Health Check” with guest speaker Andras Cser

Posted August 12, 2014    Chris Burd

BeyondTrust recently hosted a webcast presentation featuring Andras Cser, VP and Principal Analyst with Forrester Research, Inc., on “The Privileged Identity Management Health Check.” Below is a summary of key takeaways from the webcast, plus an on-demand video recording of the full presentation.

Cser shares his perspective on why Privileged Identity Management (PIM) is such an important choice for companies with sensitive data of any kind. He also explains how PIM works and discusses trends that have surfaced in the past few years.

The purpose of this webcast is to help companies understand the importance of a PIM platform and analyze recent PIM trends in threat mitigation, behavioral analytics, business user involvement, and cloud support. In this webcast, Cser offers his insight into the following four trends in PIM and how they can work for your business:

1. PIM as Threat Mitigation

According to Cser’s experience and research, 35-45% of all data breaches involve the misuse of administrative privileges. Even more disconcerting is that employee fraud monitoring does not always extend to all systems — App2App passwords are everywhere, and storing those credentials creates even more confusion and opportunities for a security breach.

We also can’t rely on the typical 10-15% tracking ratio of network forensics, because there is simply too much data to watch and store. Organizations can preempt that risk by using PIM as a part of a broad strategy to mitigate persistent threats and reduce opportunities for data breach.

2. Behavioral Analytics to Separate Out Anomalies

Fortunately, there is a way to circumvent those administrative threats. The answer is behavioral analytics. Using a quirky example of purchasing a pair of red platform Steve Madden pumps, Cser shows the audience how to use behavioral analytics to identify and understand baseline behavior. Companies can then use that information to identify anomalies in how user behaviors change and how to understand behaviors in comparison with peer groups.

Behavioral analytics represents a critical exchange of information and gives you a bird’s-eye-view of a given user’s behavior. That leads you to be able to identify (and be alerted to) behavior anomalies automatically.

3. Business User and Privileged User Overlap

Unfortunately, not all business systems support traditional Identity Access Management (IAM) – the provisioning connectors don’t exist, aren’t cost-effective to implement, and thick application integration is difficult. Shared accounts are also hard to manage and the highest sensitivity transactions may not be logged by the application in sufficient detail.

Cser points out that pre-existing PIM solutions are increasingly being used for a number of overlapping security checkpoints: shared credentials management for passwords and PKI certificates; session recording to understanding who is accessing what; tamper-resistant auditing of business user actions as a triangulation point; and for controlling company social media accounts.

PIM has expanded beyond just “talking to administrators” and now covers the intelligence needs of business users. It allows your team to create a visual risk score, chart, or dashboard to help you focus on the areas you need support in and then share that intelligence with auditors who want to know who has access to passwords and what they do when they are checked in with that password.

4. Organized and Secured Cloud Operations

Cser also shares insight into the new challenges that cloud operations bring to PIM security. These challenges include monitoring the activity and access of Infrastructure as a Service (IaaS) administrators, Platform as a Service (PaaS) administrators, and outsourced administrators – all of whom need granular access control for Hypervisor-level privileges. Virtualized guest operating systems may also be outside of the sphere of control of the owner or even the operator, making it easy to steal data from the virtualized system. To speak to these security issues, Cser calls for IT leaders to establish headless operations, or API control of and API calling from and to PIM solutions, for more secure helpdesk operations.

Managing privileged passwords, recording sessions, and delegating privileges are all PIM functions that help you run your business more quickly and at a lower long-term cost. And tools that help you manage PIM essentially help you function better as an organization.

For a cohesive approach to PIM, Cser encourages businesses to use integrated products from a minimal number of vendors and ensure high availability. He also suggests you keep login pages and scripts in all environments consistent.

For more of Cser’s insight into PIM trends, and for Forrester’s view of what’s to come, view the on-demand webcast below.

Tags:
, , , , , , , ,

Leave a Reply

Additional articles

How To Implement The Australian Signals Directorate’s Top 4 Strategies

Posted October 20, 2014    Morey Haber

The Australian Signals Directorate (ASD), also known as the Defence Signals Directorate, has developed a list of strategies to mitigate targeted cyber intrusions. The recommended strategies were developed through ASD’s extensive experience in operational cyber security, including responding to serious security intrusions and performing vulnerability assessments and penetration testing for Australian government agencies. These recommendations…

Tags:
, , , ,
asp-mvc

Exploiting MS14-059 because sometimes XSS is fun, sometimes…

Posted October 17, 2014    BeyondTrust Research Team

This October, Microsoft has provided a security update for System.Web.Mvc.dll which addresses a ‘Security Feature Bypass’. The vulnerability itself is in ASP.NET MVC technology and given its wide adoption we thought we would take a closer look. Referring to the bulletin we can glean a few useful pieces of information: “A cross-site scripting (XSS) vulnerability exists…

Tags:
4bestpracticesaudits-blog

Four Best Practices for Passing Privileged Account Audits

Posted October 16, 2014    Chris Burd

Like most IT organizations, your team may periodically face the “dreaded” task of being audited. Your process for delegating privileged access to desktops, servers, and infrastructure devices is a massive target for the auditor’s microscope. An audit’s findings can have significant implications on technology and business strategy, so it’s critical to make sure you’re prepared…

Tags:
, , , ,