BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Top 10 Reasons You Need Privileged Account Management Now

Posted July 29, 2013    Paul Harper

Don’t under estimate the complexity organizations face with managing and sharing access to privileged accounts. BeyondTrust has a wide variety of solutions that address the various challenges of privileged accounts.  Here are 10 key reasons our customers need and value the PowerBroker Password Safe solution:

1. EVERYONE has trouble managing privileged passwords – While some organizations may attempt to manually manage passwords for privileged and key accounts, that approach does not scale, does not deliver individual accountability, and does not provide an acceptable audit trail. Eventually these organizations will face an external audit and will fail. Or worse still, they will be exposed to a high visibility cyber-attack.

howtoaddsystemtopbps

How to add a system to PBPS.

2. Employees are the biggest threat – PowerBroker Password Safe, provides the individual accountability, control, and visibility necessary to limit administrative access by preventing unauthorized access to shared “superuser” accounts. High frequency password changes can also be implemented by PowerBroker PasswordSafe to provide total security of all accounts at the end of the work day.

pbps-give-AD-roles-requesting-access-to-systems

We can see in the above screenshot, we are granting this group the ‘requestor’ role as well as putting a check into ‘auditing’ so we can audit all activity made by this group.

3. Privileged account management should not be difficult or complex – PowerBroker PasswordSafe offers an all-inclusive privileged account management appliance that can be delivered in a phased approach to meet immediate requirements while easily expanding to add functionality or expand to other areas within an organization.

pbps-management-system settings

Management settings screen for systems that are managed by PBPS. The check box below enables PBPS to automatically enable password management for this system.

4. “96% of breaches were avoidable through simple or intermediate controls*” – most breaches can be avoided with a simple approval process as provided by PowerBroker Password Safe. Automatic or manual approvals for all requests, as well as ticket system integration provides true dual control over the privileged accounts. (*source: Verizon Data Breach Report)

5. Compliance demands a Password Safe – to achieve compliance (for example to SOX, PCI, HIPPA, etc.) privileged access must be controlled and shared/generic accounts should always be disabled or locked down. PowerBroker Password Safe allows the account to remain active with total password security, and adds the required accountability for anyone that needs to use the account.

pbps-manage-accounts-passwords

PBPS allows robust settings on how you would like to manage the accounts and passwords.

6. Manually changing administrator passwords result in failed audits – PowerBroker Password Safe automates administrator and all other privileged account password changes across the enterprise. Manual processes may be costing the organization hundreds of man hours annually and still leaving those accounts vulnerable to misuse.

pbps-detailed-reports-who-requested-passwords-for-specific-accounts

We also can run detailed reports on who requested passwords for specific accounts on any system in our environment.

7. Control of privileged accounts must be complemented by a complete audit trail– PowerBroker Password Safe provides full visibility and a comprehensive audit trail into which privileged accounts are being used for each system, by whom, for what, and when.

8. Hard-coded passwords in applications or scripts presents unnecessary security vulnerabilities – PowerBroker Password Safe removes the need for hard-coded passwords in applications, scripts, and for service accounts relieving the threat posed by developers having access to accounts with elevated privileges.

9. Future proofing your connector set – In order for any automated password management tool like PowerBroker Password Safe to be truly effective, wide use and adaptability are highly important factors.  PowerBroker Password Safe allows organizations to build new connectors on the fly to interoperate with customer, home-grown and other systems without default connectors. Password Safe provides this without the time and cost associated with professional services by allowing Managed Platforms to be added and customized directly from the GUI.

10. Auto-Discovery for systems and accounts – As new systems come on-line/off-line, users and admins join and leave an organization, PowerBroker Password Safe can scan your network and automatically add/remove users & systems. Auto-discovery can also be achieved using integration with common directories such as Microsoft’s Active Directory and other LDAP.

pbps-full-list-pbps-manages-incl-systems-and-accounts

For reporting, we can see a full list of what PBPS is managing for us, including systems and accounts.

Without a system of checks and balances and overall accountability for privileged and embedded passwords, an organization could expose its mission-critical systems to intentional or accidental harm, as well as malicious activity that is both difficult and costly to repair. With PowerBroker Password Safe you can now audit and control access for all types of privileged accounts like shared administrative accounts, application accounts, and local administrative accounts.

I encourage you to inquire about a free trial today of PowerBroker Password Safe…don’t tempt me to give you another reason.

Tags:
, , , , , ,

Leave a Reply

Additional articles

How To Implement The Australian Signals Directorate’s Top 4 Strategies

Posted October 20, 2014    Morey Haber

The Australian Signals Directorate (ASD), also known as the Defence Signals Directorate, has developed a list of strategies to mitigate targeted cyber intrusions. The recommended strategies were developed through ASD’s extensive experience in operational cyber security, including responding to serious security intrusions and performing vulnerability assessments and penetration testing for Australian government agencies. These recommendations…

Tags:
, , , ,
asp-mvc

Exploiting MS14-059 because sometimes XSS is fun, sometimes…

Posted October 17, 2014    BeyondTrust Research Team

This October, Microsoft has provided a security update for System.Web.Mvc.dll which addresses a ‘Security Feature Bypass’. The vulnerability itself is in ASP.NET MVC technology and given its wide adoption we thought we would take a closer look. Referring to the bulletin we can glean a few useful pieces of information: “A cross-site scripting (XSS) vulnerability exists…

Tags:
4bestpracticesaudits-blog

Four Best Practices for Passing Privileged Account Audits

Posted October 16, 2014    Chris Burd

Like most IT organizations, your team may periodically face the “dreaded” task of being audited. Your process for delegating privileged access to desktops, servers, and infrastructure devices is a massive target for the auditor’s microscope. An audit’s findings can have significant implications on technology and business strategy, so it’s critical to make sure you’re prepared…

Tags:
, , , ,