87

PAM (Privileged Access Management)

PAM (Privileged Access Management) is the aggregation of technologies and tools used for accessing, controlling, and securing access to resources and critical information of an organization. Privileged Access Management’s subcategories include application access management, vendor privileged access management, privileged session management, and common access password management.

Significantly, privileged user accounts are targets for various attacks as these accounts have inflated permissions, the ability to modify settings, and access to intimate information. A lot of damage can be made for organizational operations if compromised. Several account types that execute PAM can add local administrative, emergency cybersecurity procedure, Microsoft Active Directory, service or application, and also domain administrative accounts.

Privileged Access management tools and software implement by grouping the privileged account’s credentials (System Administrator Accounts) into any protected repository to log the activities and separate their use. The isolation is intended to reduce the admin credential’s risk of being misused and stolen. A few platforms of PAM don’t permit privileged users for selecting their passwords. Rather, the platform’s password manager will inform admins about the password or release password (one-time) all the time any admin log-in.

Features of PAM Software

PAM is essential for organizations that are constantly developing or have any complex, large IT system. Several famous vendors have started facilitating tools of enterprise PAM like Thycotic, SecureLink, CyberArk, Centrify, BeyondTrust.

Typically, PAM software and tools facilitate the following essential features:

• PAM software facilitates MFA (Multi-Factor Authentication) for administrators.
• It provides the access manager stores privileged user data and permissions.
• It facilitates the password vault stored privileged and secured passwords.
• It provides various abilities of Dynamic authorization. For example, granting approach for a particular time only.
• It facilitates session tracking only when the privileged approach is granted.
• It also provides the tools of Audit logging that support the company meets compliance.
• It gives automated deprovisioning and provisioning for reducing insider threats.

What is Privilege? How they are created?

In an IT context, privilege can be described as an authority, process and account in a computing network or system. Privilege facilitates the authorization for overriding some security constraints. It also includes acceptances to implement such operations as shutting-down the systems, configuring systems or networks, loading various device drivers, configuring and provisioning cloud instances, and accounts, etc.

Privilege serves an essential operational purpose via enabling applications, users, and some other processes of a system. The probability of abuse and misuse of privilege via outside attackers or insiders presents enterprises along with the dangerous security risk.

Depending on a system, a few privileged delegation or assignment to the public may be dependent on attributes. These attributes are role-based, like business units (for example, IT, HR, or marketing) and other parameters variety (for example, special circumstances, time of day, seniority, etc.).

Privileges for several user processes and accounts are created in the cloud management platforms, hypervisors, databases, applications, file systems, operating systems, etc. Also, privileges can be assigned by some privileged users types, like by a network or system administrators.

What is a Privileged Account?

Most of the users are working with some non-privileged accounts 90%-100% of the time. These accounts are also known as LUA (Least Privileged Accounts). Generally, it categorized into two important types which are listed below:

• Standard User Accounts: This account has a restricted set of privileges, like for internet browsing, accessing resource’s limited array, and various applications (for example, MS Office). It is often described via role-based policies.
• Guest User Accounts: These accounts possess less privilege as compared to the standard user accounts. Usually, these types of accounts are restrained to just internet browsing and application access.

Key Points of privileged accounts

Some key points of privileged accounts are as follows:

• The privileged accounts are considered to be an account that facilitates privileges and access beyond the non-privileged accounts. The privileged users are the users who are currently extracting privileged access, like from any privileged account. Due to their elevated access and capabilities, privileged accounts/privileged users pose greater risks as compared to the non-privileged users/non-privileged accounts.
• Specific privileged account types are called superuser These accounts can be utilized for administration via IT employees and facilitate unrestrained power (virtually) for executing commands. Typically, superuser accounts are called “Root” within the Linus/Unix “Administrator” in various Windows systems.
• The superuser account gives unrestricted access to directories, resources, and files with full execute/write/read privileges. It also provides power for rendering systemic modifications across any network like installing and creating software or files, modifying settings and files, and deleting data and users. Also, superusers may revoke and grant the permissions for many other users.
• All windows computers include at least a single administrator account in the Windows systems. The administrator accounts permit the user for performing such operations as modifying local settings and configurations and installing software.
• Besides, Mac OS X is Unix-like, however, unlike Linux and Unix. Rarely, it is deployed as the server. Mac endpoint users may execute with the root access as the default. Although, the non-privileged account must be used and created for custom computing to restraint the scope and likelihood of privileged hazards.

Privileged Account Examples

Here are some important examples of any privileged accounts. These accounts are commonly used in any organization:

• Domain administrative accounts: Administrative access (privileged) across every server and workstation in the domain.
• Local administrative accounts: Non-personal accounts facilitating access to an only local instance or host.
• Break glass accounts: These are also known as firecall and emergency accounts. Unprivileged users along with the administrative access for securing the systems in an emergency.
• Service accounts: Various privileged domain and local accounts can be used via a service or application for interacting with any OS.
• Domain service or active directory accounts: It facilitates password modifications to accounts, etc.
• Application accounts: These accounts are utilized by many applications for accessing databases, execute batch scripts or jobs or give access to many other applications.

What Privileged Credentials are?

Privileged credentials (also known as privileged passwords) are credential’s set that facilitates elevated permissions and access across systems, applications, and accounts. Privileged accounts are associated with service, application, human accounts, and many more. An SSH key is any privileged credential applied across organizations for accessing servers.

Privileged credentials can also be known as “secrets” especially across a DevOps environment.

The various passwords of Privileged accounts are called “the key to the IT kingdom.” It can facilitate almost endless rights for privileged access across the most critical data and systems of an organization to any authentic user, in the superuser password’s case.

Privileged Threats and Privileged Risks

Some of the most important privilege-related challenged and risks are as follows:

• Lack of awareness and visibility of privileged users, assets, credentials, and accounts: Privileged accounts, i.e., long-forgotten, are commonly rolled across the enterprises. These accounts can count in millions, and give serious backdoors for many attackers.
• Privilege’s over-provisioning: When controls of privileged access are restrictive, it can disturb user workflows, producing hindering and frustration productivity. Since rarely end users may accuse about possessing many privileges. Traditionally, IT admins arrange end users along with the privilege sets. The role of an employee is often molten and they accumulate corresponding privileges and new responsibilities.
• Shared passwords and accounts: Commonly, IT teams share a root and various other credentials of privileges for convenience. Thus, duties and workloads can be shared as required seamlessly. Although, with several people sharing the password of an account, it might be hopeless to tie activities implemented with the account to an individual. It creates compliance issues, audibility, and security.
• Embedded credentials/Hard-coded: Privileged credential is required to provide authentication for A2A (app-to-app) and A2D (application-to-database) access and communications. Commonly, systems, applications, IoT devices, and network devices are deployed and shipped with the default and embedded that are efficient guessable. Additionally, employees can hardcode secrets within the plain text, like file, code, or script, so it will be easy to access if they require it.
• Decentralized and manual credential management: Privileged credentials and accounts may be handled distinctly across several organizational silos. These are leading to the enforcement of some best practices.
• Lack of clarity into service and application account privileges: Automatically, services and application accounts often execute the privileged processes for performing many actions. Also, these accounts can communicate with many other resources, applications, services, etc. Frequently, Service and application accounts possess the right of privileged access by default, as well as suffer through other security deficiencies.
• Soiled Identity management processes and tools: Typically, modern IT environments run across one or more platforms (such as Linux, Unix, Mac, Windows, etc.), all separately managed and maintained. This practice includes complexity for every end-user, increases many cyber risks, and relates to inconsistent authority for IT.

Internal and External risk vectors

Hackers, partners, malware, and general user errors comprise the privileged risk vectors commonly. External hackers crave privileged credentials and accounts. They facilitate a speedy track for sensitive data and critical systems of an organization. The hackers become “insider” and that is a critical scenario. They can erase the tracks for avoiding detection at the time they traverse an environment of IT.

Often, hackers grab a starting foothold from any low-level exploit, like from any phishing attack over the standard user account.

VPAM (Vendor Privileged Access Management)

VPAM can be defined as the PAM’s subset that concentrates on various external threats of high-level that arrive from the reliance of an organization on outer partners to troubleshoot, maintain, or support certain systems and technologies. Representatives of these vendors need a remote privilege approach to an organization network to finish these tasks, hence posing any specific risk to IT management.

Specifically, the solutions provided by VPAM are created to manage the high-stakes and distinctive threats that the vendors of the third-party present. Users of third-party complicate the management of threats as they aren’t managed and tracked in similarly as the internal employees. VPAM supports enterprises monitor and controls privileged access of a third-party to critical systems and applications while streamlining every transient user’s management, like vendors.

Key Areas of VPAM to Reduce Risks

VPAM facilitates some key areas to reduce various risks correlated with vendor access to a third party:

• Authentication and Identification: Vendor access can be difficult for managing because of the user’s potential numbers and oversight’s lack. Therefore, implementing vendor identity management and multi-factor management methods are critical. The tools of VPAM give various options of customized authentication that can efficiently onboard and offboard users. This process prevents reps of the vendor that exit an organization from taking access along with them.
• Access Control: Permissions require to be acknowledged, once the users are authorized. A solution of VPAM provides network managers an ability to grant access permissions. It can also build a running system to fulfill the requirement’s desired set. Access control could be as normal as permitting access to any organization network application or as chapped as any single account. Also, they can schedule access via unsupervised or supervised technicians. It is convenient to add or monitor the security and efficiency of an organization.
• Auditing and Recording: The tools of VPAM monitor various user activities at the time of all sessions. It can document why, when, where, what, and who of a session of the remote support exactly. Also, the audit functionality in the VPAM platform defines that organizations can assure vendor compliance and accountability with various industry regulations.

Identity management vs. PAM

Often, PAM is confused with access and identity management. While a few overlaps endure, PAM is focused on the accounts with administrative and privileged access only, although access management encloses the users that need access to any system. IM enables the enterprises to authorize and authenticate normal access to customers, partners, and employees.

To ensure usability and security highest level, organizations must look for implementing both identity and access management. IM systems cover attack surfaces in the network of an organization while PAM covers high-valued and smaller attack surfaces.

PAM Implementation

Various processes of PAM struggle for controlling the privilege risk. Pre-packed and automated solutions are available for scaling across all the privileged accounts, assets, and users to enhance compliance and security.

The solutions may automate management and discovery to reduce gaps within the credential coverage/privileged account, while streamlining the workflows for reducing various administrative complexities.

---