BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

BeyondTrust Webcast: “The Privileged Identity Management Health Check” with guest speaker Andras Cser

Posted August 12, 2014    Chris Burd

BeyondTrust recently hosted a webcast presentation featuring Andras Cser, VP and Principal Analyst with Forrester Research, Inc., on “The Privileged Identity Management Health Check.” Below is a summary of key takeaways from the webcast, plus an on-demand video recording of the full presentation.

Cser shares his perspective on why Privileged Identity Management (PIM) is such an important choice for companies with sensitive data of any kind. He also explains how PIM works and discusses trends that have surfaced in the past few years.

The purpose of this webcast is to help companies understand the importance of a PIM platform and analyze recent PIM trends in threat mitigation, behavioral analytics, business user involvement, and cloud support. In this webcast, Cser offers his insight into the following four trends in PIM and how they can work for your business:

1. PIM as Threat Mitigation

According to Cser’s experience and research, 35-45% of all data breaches involve the misuse of administrative privileges. Even more disconcerting is that employee fraud monitoring does not always extend to all systems — App2App passwords are everywhere, and storing those credentials creates even more confusion and opportunities for a security breach.

We also can’t rely on the typical 10-15% tracking ratio of network forensics, because there is simply too much data to watch and store. Organizations can preempt that risk by using PIM as a part of a broad strategy to mitigate persistent threats and reduce opportunities for data breach.

2. Behavioral Analytics to Separate Out Anomalies

Fortunately, there is a way to circumvent those administrative threats. The answer is behavioral analytics. Using a quirky example of purchasing a pair of red platform Steve Madden pumps, Cser shows the audience how to use behavioral analytics to identify and understand baseline behavior. Companies can then use that information to identify anomalies in how user behaviors change and how to understand behaviors in comparison with peer groups.

Behavioral analytics represents a critical exchange of information and gives you a bird’s-eye-view of a given user’s behavior. That leads you to be able to identify (and be alerted to) behavior anomalies automatically.

3. Business User and Privileged User Overlap

Unfortunately, not all business systems support traditional Identity Access Management (IAM) – the provisioning connectors don’t exist, aren’t cost-effective to implement, and thick application integration is difficult. Shared accounts are also hard to manage and the highest sensitivity transactions may not be logged by the application in sufficient detail.

Cser points out that pre-existing PIM solutions are increasingly being used for a number of overlapping security checkpoints: shared credentials management for passwords and PKI certificates; session recording to understanding who is accessing what; tamper-resistant auditing of business user actions as a triangulation point; and for controlling company social media accounts.

PIM has expanded beyond just “talking to administrators” and now covers the intelligence needs of business users. It allows your team to create a visual risk score, chart, or dashboard to help you focus on the areas you need support in and then share that intelligence with auditors who want to know who has access to passwords and what they do when they are checked in with that password.

4. Organized and Secured Cloud Operations

Cser also shares insight into the new challenges that cloud operations bring to PIM security. These challenges include monitoring the activity and access of Infrastructure as a Service (IaaS) administrators, Platform as a Service (PaaS) administrators, and outsourced administrators – all of whom need granular access control for Hypervisor-level privileges. Virtualized guest operating systems may also be outside of the sphere of control of the owner or even the operator, making it easy to steal data from the virtualized system. To speak to these security issues, Cser calls for IT leaders to establish headless operations, or API control of and API calling from and to PIM solutions, for more secure helpdesk operations.

Managing privileged passwords, recording sessions, and delegating privileges are all PIM functions that help you run your business more quickly and at a lower long-term cost. And tools that help you manage PIM essentially help you function better as an organization.

For a cohesive approach to PIM, Cser encourages businesses to use integrated products from a minimal number of vendors and ensure high availability. He also suggests you keep login pages and scripts in all environments consistent.

For more of Cser’s insight into PIM trends, and for Forrester’s view of what’s to come, view the on-demand webcast below.

Tags:
, , , , , , , ,

Leave a Reply

Additional articles

Dark Reading

2014: The Year of Privilege Vulnerabilities

Posted December 18, 2014    Chris Burd

Of the 30 critical-rated Microsoft Security Bulletins this year, 24 involved vulnerabilities where the age-old best practice of “least privilege” could limit the impact of malware and raise the bar of difficulty for attackers.

Tags:
, , , , ,
dave-shackleford-headshot

Looking back on information security in 2014

Posted December 16, 2014    Dave Shackleford

Dave Shackleford is a SANS Instructor and founder of Voodoo Security. Join Dave for a closer look at the year in security, and learn what you can do to prepare for 2015, with this upcoming webinar. 2014 has been one heck of an insane year for information security professionals. To start with, we’ve been forced…

Tags:
, ,
patch-tuesday

December 2014 Patch Tuesday

Posted December 9, 2014    BeyondTrust Research Team

This month marks the final Patch Tuesday of 2014. Most of what is being patched this month includes Internet Explorer, Exchange, Office, etc… and continues a trend of the greatest hits collection of commonly attacked Microsoft software. Probably the one thing that broke the mold this month is that for once there is not some…

Tags:
,