BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Top 10 Reasons You Need Privileged Account Management Now

Posted July 29, 2013    Paul Harper

Don’t under estimate the complexity organizations face with managing and sharing access to privileged accounts. BeyondTrust has a wide variety of solutions that address the various challenges of privileged accounts.  Here are 10 key reasons our customers need and value the PowerBroker Password Safe solution:

1. EVERYONE has trouble managing privileged passwords – While some organizations may attempt to manually manage passwords for privileged and key accounts, that approach does not scale, does not deliver individual accountability, and does not provide an acceptable audit trail. Eventually these organizations will face an external audit and will fail. Or worse still, they will be exposed to a high visibility cyber-attack.

howtoaddsystemtopbps

How to add a system to PBPS.

2. Employees are the biggest threat – PowerBroker Password Safe, provides the individual accountability, control, and visibility necessary to limit administrative access by preventing unauthorized access to shared “superuser” accounts. High frequency password changes can also be implemented by PowerBroker PasswordSafe to provide total security of all accounts at the end of the work day.

pbps-give-AD-roles-requesting-access-to-systems

We can see in the above screenshot, we are granting this group the ‘requestor’ role as well as putting a check into ‘auditing’ so we can audit all activity made by this group.

3. Privileged account management should not be difficult or complex – PowerBroker PasswordSafe offers an all-inclusive privileged account management appliance that can be delivered in a phased approach to meet immediate requirements while easily expanding to add functionality or expand to other areas within an organization.

pbps-management-system settings

Management settings screen for systems that are managed by PBPS. The check box below enables PBPS to automatically enable password management for this system.

4. “96% of breaches were avoidable through simple or intermediate controls*” – most breaches can be avoided with a simple approval process as provided by PowerBroker Password Safe. Automatic or manual approvals for all requests, as well as ticket system integration provides true dual control over the privileged accounts. (*source: Verizon Data Breach Report)

5. Compliance demands a Password Safe – to achieve compliance (for example to SOX, PCI, HIPPA, etc.) privileged access must be controlled and shared/generic accounts should always be disabled or locked down. PowerBroker Password Safe allows the account to remain active with total password security, and adds the required accountability for anyone that needs to use the account.

pbps-manage-accounts-passwords

PBPS allows robust settings on how you would like to manage the accounts and passwords.

6. Manually changing administrator passwords result in failed audits – PowerBroker Password Safe automates administrator and all other privileged account password changes across the enterprise. Manual processes may be costing the organization hundreds of man hours annually and still leaving those accounts vulnerable to misuse.

pbps-detailed-reports-who-requested-passwords-for-specific-accounts

We also can run detailed reports on who requested passwords for specific accounts on any system in our environment.

7. Control of privileged accounts must be complemented by a complete audit trail– PowerBroker Password Safe provides full visibility and a comprehensive audit trail into which privileged accounts are being used for each system, by whom, for what, and when.

8. Hard-coded passwords in applications or scripts presents unnecessary security vulnerabilities – PowerBroker Password Safe removes the need for hard-coded passwords in applications, scripts, and for service accounts relieving the threat posed by developers having access to accounts with elevated privileges.

9. Future proofing your connector set – In order for any automated password management tool like PowerBroker Password Safe to be truly effective, wide use and adaptability are highly important factors.  PowerBroker Password Safe allows organizations to build new connectors on the fly to interoperate with customer, home-grown and other systems without default connectors. Password Safe provides this without the time and cost associated with professional services by allowing Managed Platforms to be added and customized directly from the GUI.

10. Auto-Discovery for systems and accounts – As new systems come on-line/off-line, users and admins join and leave an organization, PowerBroker Password Safe can scan your network and automatically add/remove users & systems. Auto-discovery can also be achieved using integration with common directories such as Microsoft’s Active Directory and other LDAP.

pbps-full-list-pbps-manages-incl-systems-and-accounts

For reporting, we can see a full list of what PBPS is managing for us, including systems and accounts.

Without a system of checks and balances and overall accountability for privileged and embedded passwords, an organization could expose its mission-critical systems to intentional or accidental harm, as well as malicious activity that is both difficult and costly to repair. With PowerBroker Password Safe you can now audit and control access for all types of privileged accounts like shared administrative accounts, application accounts, and local administrative accounts.

I encourage you to inquire about a free trial today of PowerBroker Password Safe…don’t tempt me to give you another reason.

Tags:
, , , , , ,

Leave a Reply

Additional articles

Dark Reading

2014: The Year of Privilege Vulnerabilities

Posted December 18, 2014    Chris Burd

Of the 30 critical-rated Microsoft Security Bulletins this year, 24 involved vulnerabilities where the age-old best practice of “least privilege” could limit the impact of malware and raise the bar of difficulty for attackers.

Tags:
, , , , ,
dave-shackleford-headshot

Looking back on information security in 2014

Posted December 16, 2014    Dave Shackleford

Dave Shackleford is a SANS Instructor and founder of Voodoo Security. Join Dave for a closer look at the year in security, and learn what you can do to prepare for 2015, with this upcoming webinar. 2014 has been one heck of an insane year for information security professionals. To start with, we’ve been forced…

Tags:
, ,
patch-tuesday

December 2014 Patch Tuesday

Posted December 9, 2014    BeyondTrust Research Team

This month marks the final Patch Tuesday of 2014. Most of what is being patched this month includes Internet Explorer, Exchange, Office, etc… and continues a trend of the greatest hits collection of commonly attacked Microsoft software. Probably the one thing that broke the mold this month is that for once there is not some…

Tags:
,