BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

M&M Security Bound To Be Eaten Without Least Privilege

Posted November 28, 2011    Peter McCalister

No, I’m not talking about the Mars candy, funny characters pervasive on your TV, or even the legendary brown ones from a Van Halen concert rider.

I am referring to how the popular candy has been used as a metaphor for IT security because it reflects the common practice of hardening your perimeter with firewalls, access and authentication solutions (hard candy shell) while allowing any insider almost free reign to do as they please once inside your enterprise or extended enterprise network (soft chocolate center).

mandm-1

Billions of dollars have been spent over the last few decades on corporate information technology (IT) security in order to “keep the bad guys out,” but it turns out the bigger threat was and always has been found within the network perimeter. The so called “insider threat,” the trusted employee, contractor, or partner, that can cost an organization more on a daily and/or per-incident basis than any outside hacker could hope for.

Whether we like it or not, “good people do bad things” intentionally, accidentally, or indirectly. This is the premise upon which the new book “Preventing Good People From Doing Bad Things, Implementing Least Privilege” is based. In this book, you can learn from your peers how to avoid the embarrassments and costs that they have already experienced.

Hopefully your privilege identity management practices won’t melt in someone else’s mouth instead of yours.

Leave a Reply

Additional articles

webinar 2

On Demand Webinar: Because Auditing Stinks Sometimes

Posted July 2, 2015    Lindsay Marsh

Auditing stinks. Well, mostly stinks. In this on demand webinar, lead by Group Policy MVP Jeremy Moskowitz, you’ll learn the three key tenets to real Group Policy auditing. Tenet 1: Why do you care about Group Policy auditing? Tenet 2: How does Eventing help you know “Who did what?” Tenet 3: How does Reporting tell…

Tags:
, , , ,
skeletonkey3_713678_713680

Stopping the Skeleton Key Trojan

Posted June 29, 2015    Robert Auch

Earlier this year Dell’s SecureWorks published an analysis of a malware they named “Skeleton Key”. This malware bypasses authentication for Active Directory users who have single-factor (password only) authentication. The “Skeleton Key” attack as documented by the SecureWorks CTU relies on several critical parts.

Tags:
, , , , ,
webinar 2

On Demand Webinar: 10 Steps to Building an Effective Vulnerability Management Program

Posted June 26, 2015    BeyondTrust Software

In this on demand webinar, Cybersecurity Expert, Derek A.Smith will take you through his 10 steps for a successful vulnerability management program and how to get started now.

Tags:
, ,