BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Gimme Shelter … From Governance, Risk & Compliance Issues

Posted February 28, 2011    Peter McCalister

In the on-going debate of best rock band ever between the Beatles and the Rolling Stones, I have, and will ever, fall into the Stones camp.  With that said, this is a least privilege forum so I need to endeavor to stick to the subject at hand as Keith’s guitar wails in the background and Mick’s vocal starts “Oh, a storm is threatening.”

Today’s blog will take a look at Governance, Rick & Compliance (GRC) from the least privilege perspective and in the process provide some much needed shelter for IT from the potential of a failed audit.

There are three critical steps to “get shelter” from GRC issues:

  1. Get the lay of the land:  you won’t know where you are at risk if you don’t have complete control over who has access to what and what can privileged users do.
  2. Stop making assumptions: this is often the most tragic mistake.  Assuming you know the answers to question 1 and/or trusting your privileged users without any form of automated verification.
  3. Consult compliance checklists: this may seem like an obvious step but all too often is it overlooked or current checklists failed to be secured and referenced.

“…it’s just a shot away…”

The US Department of Defense has an Information Assurance and Accreditation Process(DIACAP) to provide a standard process for all DoD information systems will achieve and maintain the “Authority To Operate.”  There are too many similar websites to list here for the thousands of other regulations globally, but follow these three steps and you’ll be breathing easier during the next audit. So, as Mick sings “gimme, gimme shelter or I’m gonna fade away” I sign off and offer this whitepaper on US Federal compliance for your reading pleasure.

Leave a Reply

Additional articles

Sudo_logo

Don’t Create a Different sudoers File for Each System

Posted May 20, 2015    Randy Franklin Smith

What if you have multiple Linux and/or Unix systems? Sudo management can become onerous and unwieldy if you try to manage a different sudoers file on each system. The good news is that sudo supports multiple systems.

password-safety

What Does Microsoft Local Administrator Password Solution Really Do?

Posted May 19, 2015    Morey Haber

LAPS is a feature that allows the randomization of local administrator accounts across the domain. Although it would seem that this capability overlaps with features in BeyondTrust’s PowerBroker Password Safe (PBPS), the reality is it is more suited for simple use cases such as changing the local Windows admin account and not much more.

Tags:
, ,
webinar_ondemand

On Demand Webinar: Securing Windows Server with Security Compliance Manager

Posted May 14, 2015    BeyondTrust Software

On Demand Webinar: Security Expert Russell Smith, explains how to use Microsoft’s free Security Compliance Manager (SCM) tool to create and deploy your own security baselines, including user and computer authentication settings.

Tags:
, ,