por Rebeca | Feb 16, 2022 | Sin Categoria
Remote working is here to stay, and the channel is pivotal in supporting organisations in their efforts to maintain the best protection against cyber attacks whether they’re adopting a hybrid, or fully remote working model. Channel partners with a rich portfolio of security solutions are in the ideal position to facilitate these flexible models and provide organisations with the seamless IT support they need to connect workers securely, irrespective of their location.
At the heart of remote cyber security is privileged access management (PAM), the protection around privileged and sensitive user accounts, which are the crown jewels for cyber criminals. For the channel, PAM creates a new revenue stream and further business opportunities with their customers. However, while having unrestricted access to clients’ IT estates is part and parcel for a service provider, it does pin a huge target on their backs. Offering comprehensive PAM solutions will enable channel partners to secure, manage and monitor access to their own privileged accounts as well as those of their clients, keeping the most valuable keys to their network safe.
Privileged Access Management can provide partners with greater security not only for their clients but for their own accounts too
In today’s cyber environment, stolen and misused privileged accounts—and the access they afford to sensitive and critical data and hosts—can be used to inflict tremendous damage.
Implementing a PAM tool reduces the likelihood of privileged credentials being compromised or misused in both external breaches and insider attacks. Such tools also help reduce the impact of an attack when it occurs by radically shortening the time during which the organization is unaware that it is under attack or being subverted. Cloud security, anomaly detection, and securing the software development life-cycle also can be addressed with a PAM tool, as can regulatory compliance and operational efficiency.
PAM solutions need to be aware of not only who a user is, but also to which resources they should be granted privileged access. To enhance security even further, strong PAM solutions tend to have their own layers of security capabilities. That is, they will have the ability to limit user access not only by role, but also by other factors such as time and location, ensuring that even a user who has been authenticated only sees the specific resource to be accessed, and only when appropriate. As a quick example, a given user may be granted privileged access to a server to do an update because they have the role of server admin; but the PAM administrators might also limit that privileged access, for business reasons or simply as a security practice, to a two-hour window starting at midnight, for example. Outside of that time frame, even with the login credentials, the user won’t be able to access the server for good or malicious reasons.
Multifactor Atuthentication (MFA) & Privileged Account Management (PAM)
If a user has successfully authenticated to the system, the PAM system will provide the user the privileged access they have been granted. Of course, that’s entirely appropriate, when the user is who they say they are – but potentially disastrous when a privileged user within the system is not who they claim to be.
Strong PAM solutions have safeguards to protect against this very situation. Session management tools, for example, will alert the security team (or automatically kill the session) when the activity undertaken by a privileged user is outside of defined parameters, such as a purported database administrator who suddenly begins to rapidly execute a large number of queries against multiple databases.
But what of the case where a hacker has stolen a DBA’s credentials, gained entrance to the system, and then undertakes activity which does not raise alarms, such as running an occasional query as the legitimate DBA might do?
This is the kind of situation prevented by MFA and PAM solutions working together to truly provide a layered defense in depth. Where strong PAM solutions excel at providing only the appropriate access to privileged users, a strong MFA capability in front of PAM helps to ensure that users are who they say are before they ever reach the point at which privileges must be determined and granted.
It’s a layered strategy that truly helps security teams and administrators create a defense-in-depth – and in today’s networked environments that are subjected to constant probing and hacking attempts, it’s a solid way to increase a firm’s cybersecurity.
References:
(1) Newsweek.com
(2) secureworld.com
(3) Dark Reading
Picture: <a href=’https://www.freepik.es/fotos/negocios’>Foto de Negocios creado por jannoon028 – www.freepik.es</a>
por Rebeca | Jun 23, 2021 | Ciberseguridad, Soffid
Privileged Account Management is considered by many analysts and technologists as one of the most important security projects for reducing cyber risk and achieving high security ROI.
Based on recent threat activity, privileged accounts, not corporate data, might be the most valuable items within enterprise networks.
The domain of priviledge management is generally accepted as falling within the broader scope of identity and access management (IAM). Together, PAM and IAM help to provide fined-grained control, visibility, and auditability over all credentials and privileges.
While IAM controls provide authentication of identities to ensure that the right user has the right access as the right time, PAM layers on more granular visibility, control, and auditing over privileged identities and activities.
In a Tuesday session, titled «Security Leader’s Guide to Privileged Access Management,» Gartner research director Felix Gaehtgens said privileged access management is a crucial component of any security program because of the increasingly large scope of IT environments, privileged users, administrative tools, and IAM data such as passwords, encryption keys and certificates. Gaehtgens recommended organizations implement strict controls on privileged access such as limiting the total number of personal privileged accounts, creating more shared accounts and reducing the times and durations during which privileged access is granted.
It is a pleasure to invite you to our new webinar we are celebrating today, 23rd June.
During the webinar we will discuss about how PAM is emerging as one of the hottest topics in cybersecurity and why it must be a part of your overall IAM strategy.
por Rebeca | Jun 9, 2021 | Ciberseguridad, Soffid
The 2020 Global State of Least Privilege Report shows that two-thirds of organizations now consider the implementation of least privilege a top priority in achieving a zero-trust security model.
Below, we take a look at some of the critical drivers for the adoption of least privilege. We also explore the failure of traditional systems and how modern solutions such as Software-Defined Perimeter, Secure Web Gateway and Risk-Based Authentication, among others, engender greater enterprise network security.
Access is Responsibility
According to an Identity Defined Security Alliance (IDSA) study published last year, 79% of enterprises experienced an identity-related security breach in the previous two years. Last year, just as the COVID-19 pandemic gathered momentum, another report revealed a rise in attacker access to privileged accounts, which puts businesses at a greater risk.
It is important to note that in this age where data is everything, access is equal to responsibility. Therefore, the greater access a person has at a given moment, the greater responsibility they have to protect the data that they have access to. According to the State of Security blog, author Anastasios Arampatzis states that the central goal of privilege access management, which he admits covers many strategies, is the enforcement of least privilege.
Privileged accounts are a liability precisely because the data they have access to makes them attractive targets to cyber attackers. The greater the level of access an account has, the more significant the impact of an attack would be. More so, the greater the number of privileged accounts on a network, the more catastrophic an account compromise could be. Basically, every additional privileged account multiplies the risks on a network. Therefore, it is crucial to keep the circle of privilege small in order to limit unnecessary data exposure.
Legacy Systems: The Failure of VPNs to Adequately Secure
Amidst the current challenges in privileged access management, organizations are beginning to explore alternative solutions to traditional VPN technology and other legacy security solutions which have failed in actively securing privileged accounts. One notable problem is the lack of remote user security on many VPN products, and they neither integrate well with identity providers nor properly implement user policies on identity access and authorization. The weakness of VPNs are made more apparent in this age of remote work.
At the turn of the pandemic, companies had to allow their employees to work from home. This led to a surge in VPN adoption. According to the Global VPN Adoption Index report, VPN downloads reached 277 million in 2020 based on data collected from 85 selected countries.
The cybersecurity landscape can be described as a kind of cat-and-mouse race. In response to this trend, cyber attackers shifted their focus to exploiting VPNs, amongst other techniques such as phishing. However, being a legacy technology that has somehow due to its ubiquity made its way to more modern times, VPNs have become quite weak. Based on the assertion that “VPNs are designed to secure data in transit, not necessarily to secure the endpoints,” it is easy to see why the ‘new normal’ in cybersecurity is the protection of endpoints in an age where data is gold.
Least Privilege Solutions and Technologies
The current overhauling of our approaches to access management and authentication has given birth to the rising adoption of the cybersecurity of least privilege. This principle is connected to another swelling trend in cybersecurity: the zero-trust model.
Zero trust cybersecurity entails the withholding of access to a protected network until legitimate authorization is established. Access control and identity management are part of the components of a zero trust security architecture.
True zero trust technologies adopt the principle of least privilege by default.
The need for privileged accounts is common to most information systems. These accounts are necessary to perform scheduled configuration and maintenance tasks, as well as supervening tasks such as the recovery of a hardware or software failure or the restoration of a backup. Due precisely to the need to use these accounts in an unplanned manner, their management must combine security, procedures and flexibility.
In order to effectively manage these accounts, the Soffid product has the necessary logic to Identify accounts, classify them according to the level of risk and its scheme of use, distribution and assignment to responsible users, automatic and planned password change process, passwords delivery process to authorized users and automatic injection of passwords, when this injection applies and makes sense.
Conclusion
The principle of least privilege in cybersecurity is not just an exciting fad that would go away soon. Rather, it is becoming a standard model and best practice for network protection in the new normal of cybersecurity.
Implementing least privilege works like buying insurance; the strength and impact of an attack can be measured by the level of privilege a compromised account has. This can put things into perspective in fighting data breaches.
Sources:
(1) Tripwire
(2) Security Tech
por Rebeca | Abr 7, 2021 | Sin Categoria
No one wants a security breach to happen, but the media will be sure to pick it up when it does. By then, it is too late. Millions of dollars in fines or ransom notes later, and with a tarnished marketplace reputation, the company or government agency wishes they had paid more attention to their security protocols.
One way to achieve higher security is to instill a proper Privileged Access Management (PAM) initiative into the cybersecurity workflow. PAM is the process of determining who has access to what types of information as it creates an integrated view of risk, threats, and controls. PAM incorporates all-encompassing methodologies for how to use identities securely, how to enable logging and auditing for privileged identities for the quickest cyberattack response, and how to define what is privilege and what is not for an organization. In other words, PAM refers to a multi-dimensional cybersecurity strategy involving processes, technology, and people that aims to secure and monitor both human and non-human (machine)-privileged activities and identities throughout an organization’s IT landscape. For it to be successful, any such system has to be a part of the entity’s culture.
Privileged Access Management (PAM) helps organisations provide secure access to critical applications and data by addressing the very first security layer – the passwords.
Why is this important?
For hackers getting access to Admin or super user passwords is like hitting the goldmine – instant access to an organisations most critical assets and potentially right across the network
Key benefits
There are many benefits of a robust PAM system. Its effectiveness is enhanced with the knowledge of how to determine risk tiers, how guidelines are established, and best practices for implementing procedures, including how to overcome team-level resistance. Not having a protective system is imprudent. PAM providers offer various methods that achieve comparable results and benefits.
- It sets up the equivalent of a barrier wall to guard against attacks.
- It helps mitigate risk by ensuring compliance and confirmation with integrity.
- It improves IT efficiency for application teams by increasing efficiency and enabling seamless user workflows.
- It integrates with other tools to further enhance the organization’s cyber maturity as it creates more layers of security.
- It acts as a centralized system with clean dashboards, reports on systems in place, and an AI-assisted subsystem to provide safety based on user profile and risk factors.
Tools
Key features include a layering of sound, proven security protocols atop hardware, software, technology assists, and culture shifts.
- One key protocol is granting the least privilege possible while still getting the job done.
- Storing multiple-use passwords is dangerous.
- Leveraging AI decreases team member “slips” through automated monitoring, reporting to dashboards and real time alerts that are also used in many industries’ audits.
- Training must include accountability and responsibility, even using screen-recording capabilities to train entry-level resources and monitor third party vendor access to protect the organization.
Sometimes losing a customer or a breach itself will be the catalyst for establishing new and better guidelines. Ideally, a report showing minor violations ahead of a problem would trigger a new guideline. Sometimes the Chief Information Security Officer (CISO) needs an inventory in the form of a “gap” analysis of where the company is versus where it would like to be protection-wise. From there, guidelines and levels of access can be created, tightened and enforced.
Determining appropriate levels of access across the enterprise might seem numbingly painful and time consuming. However, access identifiers must travel the full length and breadth of the organization and are a critical preemptive measure against cyberattacks. Sometimes the step is rushed in the attempt to do something — anything, to stop attackers. Industry PAM suppliers such as CyberArk, Centrify, and Thycotic offer company-specific combinations of determining appropriate privileged access levels that start at the tippy top of the IT system (the CISO or CIO for example) and rain down across and through workstations within or among network domains. The contradiction of job title against access point challenges all systems. Cyber attackers have infiltrated structures as large as Yahoo and the U.S. Office of Personnel Management by finding and exploiting privileged credentials. The exact level of access comes down to adhering to a few generally accepted best practices.
Start by answering the questions below to build a tight, impenetrable system:
- Who has access to critical infrastructure, systems, and data? Build access levels from the ground up and top down. Study automatically updated reports daily. A reputable PAM cloud or on-premise solution can inform this step.
- Does the company use the tools/solutions they have efficiently? Are they making time to have meetings, train the troops, and enforce the protocols in place? How mature are users’ knowledge base and how recent are the tools? Is everyone on board to secure the company’s digital assets?
- Is there an adequate budget for purchasing recognized Privileged Access Management software and the support that comes with it?
- How do external audit findings reflect compliance? Examples are General Data Protection Regulation (GDPR) for the EU and Network Information Service (NIS) in the U.S. Are failures quickly fixed?
- Is management at all levels supporting or thwarting safety measures? Getting the job done is not as important as getting the job done safely.
There are many challenges to maintaining a safe yet productive and efficient IT environment. Surprisingly, one of the most challenging roadblocks with Privileged Access Management systems is not making the financial investment to purchase them. The greater challenge is often overcoming employees’ general resistance to change and “adding one more thing” to complete their day-to-day activities. Whether for budgetary, personnel, or other reasons, this resistance puts the company at risk. Meanwhile, as user-friendly and feature-rich as the best PAM systems are, the ultimate test is micro-managing all the way down to the customer-facing employees. These are the bastions of protection against internal (unfortunately) and external marauder/cyber attackers chipping against the walls of the IT fortress. Stretched team managers do their best to hold their team members accountable, but they cannot afford to fire their noncompliant employees. The work must be done, so the task often becomes one of negotiating with an employee. “Here are ten things we need you to do. Do two now, and we’ll work on the next ones in coming weeks.”
But coming weeks may bring newer protocols. The task is ongoing, because next week may require more and different responses and procedures depending on the attackers’ targets, be it Big Data, the Cloud, DevOps, Databases, the Infrastructure, or Network Devices. Last month’s Multi-Factor Authentication (MFA) might need strengthening. As quickly as the Bad Guys change their strategies, the technologies to keep them out must change apace.
Sources:
(1) Security Magazine
(2) Security Intelligence
por Rebeca | Feb 10, 2021 | Soffid
As businesses reflect on the disruption caused by the COVID-19 crisis, ensuring agility and resilience have risen to the top of C-suite agendas everywhere.
Administrative users require privileged account access in their day-to-day roles to maintain systems, perform upgrades and troubleshoot issues. However, these users can also misuse their privileges to gain unauthorized access to sensitive information or cause damage to the IT environment. To deter the misuse of privileges by authorized users, as well as detect malicious activity that could indicate a compromised account, organizations should proactively record and monitor all privileged session activity.
It’s great to have a session recording tool that recorded everything users do on the command line, it might prevent some oversights from happening in the first place if users are aware that what they were doing will being recorded. After all, people are usually on their best behavior when they know they are being recorded.
Key Benefits:
- Cost and time savings– both admins and developers need to use less time for non-productive routines and can concentrate on real value-adding tasks.
- Improved security– not having to generate, rotate, and dispose of passwords or keys improves your security posture and reduces your attack surface. Ditto for the automatic revocation of access rights upon someone leaving the organisation and not having to worry about lost credentials.
- Improved compliance– with detailed audit logs and the available session recording and playback and integration with SIEM systems, you get full visibility into who has done what, where, and when. This not only gives you peace of mind, but it also helps you stay on the right side of GDPR and other regulations.
- Better user experience– while a great customer experience is something we often think about, improving the user experience easier is often equally valuable.
Report and audit privileged sessions that leverage shared accounts and individual accounts with full video and metadata capture. The Soffid Audit and Monitoring Service allows customers to conduct analysis and leverage high-fidelity recordings for audit and compliance purposes.
