Privileged Access Management
Privileged access management (PAM) is defined as the provisioning of tools that help organizations manage and secure accounts that have access to critical data and operations. Any compromise in these ‘privileged’ accounts can lead to financial losses and reputational damage for the organization.
Every organization’s infrastructure is built with multiple levels of deployments, data stores, applications, and third-party services. Some of these components are critical for operations, while some may be as mundane as email.
But each
of these is accessed by user accounts, which are of two types:
Human users: They are typically employee
accounts, encompassing all departments, including HR, DevOps, and network
administrators.
Automated non-human users: These are third-party applications and services that require an account to integrate with the organization’s systems.
‘Privilege’
is defined as the authority that an account has to modify any part of the
company’s technology architecture, starting from individual devices to the
office network. This privilege allows the bypassing of security restraints that
are normally applied across all accounts.
A standard account is a norm among employees, with the least privileges attached to it. These accounts are used to access and operate limited resources such as internet browsing, emails, and office suites. A privileged account possesses more capabilities than a standard account. This elevated access is gained using privileged credentials.
Despite the numerous headline-making incidents
in recent years, cybercrime continues to rise with reported data breaches
increasing by 75% over the past two years. For those that suffer a breach, the
repercussions can be costly:
increased public scrutiny, costly fines, decreased customer loyalty and reduced revenues. It is no wonder that cybercrime has risen towards the top of the concern list for many organisations and the customers with whom they do business.
You’ve heard many of the stories.
Equifax, Uber, Facebook, My Heritage, Under Armor, and Marriott. Personal data
from millions of their customers was stolen. Even though the number of breaches
went down in the first half of 2018, the number of records stolen increased by
133 percent to almost 4,5 billion records
worldwide. Unfortunately things are
only likely to get worse. According to a 2018 study from Juniper Research, an
estimated 33 billion records will be stolen in 2023 – this represents a 275
percent increase from the 12 billion records
that are estimated to have been stolen
in 2018.
Are you ready for more bad news? Thanks
to the demands of the application economy, the threat landscape has expanded
and protecting against these threats has only gotten more challenging.
Victims
of the future
Digital
transformation is a necessity for organisations to not only survive, but thrive
in the application economy. But these transformations are creating an expanding
set of new attack surfaces that must be defended, in addition to the
existing
infrastructure that you’ve been protecting for years. These new points of
vulnerability include:
DevOps adoption: In more sophisticated IT shops,
continuous delivery/ continuous testing practices have introduced automated processes
that see no human intervention at all. In many cases, these scripts or tools are
often using hard-coded administrative credentials that are ripe for theft and
misuse.
Hybrid environments: As your IT environment has evolved
to include
software-defined
data centres and networks, and expanded outside of your four walls to
incorporate public cloud resources and software-as-a-service (SaaS)
applications, the traditional way of approaching administration and management
quickly falls apart – mainly because it fails to protect new attack surfaces like
management consoles and APIs.
Internet of Things: Smart devices are proliferating in
our lives, from phones to watches, from refrigerators and cars to medical
implants and industrial machinery. And because these devices have connectivity,
not only can they be hacked, but they are already being compromised where
security is inadequate or non-existent.
Third-party access: Outsourcing development or IT
operations has become the
norm. In
addition, many companies are sharing information with partners. However, many
of these third-party employees are being granted ‘concentrated power’ via
administrative access. Who is watching how they are using or potentially
misusing that access?
Take
hold of the flame
Stealing
and exploiting privileged accounts is a critical success factor for types of
attacks. This is not surprising when one considers that privileged identities
have access to the most sensitive resources and data in your environment; they
literally hold the keys to the kingdom.
Thankfully,
there is a positive angle you can take on this fact. If privileged accounts are
the common thread amongst the innumerable attack types and vulnerability
points, then these accounts – and the credentials associated with them – are
exactly where you should focus your protection efforts.
For
many, focusing on ‘privileged users’ is difficult because its population can be
so diverse. Privileged accounts and access are not just granted to employees
with direct, hands-on responsibility for system administration, but also to
contractors and business partners. You may even have privileged unknowns who
are securing ‘shadow IT’ resources without your knowledge. And finally, in many
cases, privileged accounts aren’t even people – they may be applications or
configuration files empowered by hard-coded administrative credentials.
This
begs the question, if you can’t even get a clear tally of who represents your
privileged user population, how can you hope to protect these accounts?
By securing those accounts at each stop along the breach kill chain.
Breaking
the chains
What
is a kill chain? It’s the series of steps an attacker typically follows when
carrying out a breach. While the chain can comprise numerous steps, there are
four key ones in which privileged credentials represent the cornerstone of an
attack. These include:
1. Gain access and expand: To access the network, insiders might exploit the credentials they already have, while outsiders will exploit a vulnerability in the system to steal the necessary credentials.
2. Elevate
privileges: Once inside, attackers will often try to elevate their
privileges, so they can issue commands and gain access to whatever resources
they’re after.
3. Investigate
and move laterally: Attackers rarely land in the exact spot where the data
they’re seeking is located, so they’ll investigate and move around in the
network to get closer to their ultimate goal.
4. Wreak havoc: Once they have the credentials they need and have found exactly what they’re looking for, the attackers are free to wreak havoc (e.g. theft, business disruption, etc.).
If you
can prevent an unauthorised user – insider or outsider – from gaining access to
the system in the first place, you can stop an attack before it even starts.
To
prevent unauthorised access, you must:
•
Store all privileged credentials in an encrypted vault and rotate these
credentials on a periodic basis.
•
Authenticate all users, applications, and services before granting access to
any
privileged
credential.
• Employ automatic login and single sign-on so users never know the privileged credential.
Limiting
privilege escalation
In many networks, it’s common for users to have access to more resources than they actually need – which means attackers can cause maximum damage quickly and even benign users can cause problems inadvertently. This is why granular access controls are so important.
To limit
privilege escalation, you must:
• Adopt a
‘zero trust’ policy that only grants access to the systems people need for
work.
•
Implement filters and white/black lists to enable fine-grained access controls.
• Proactively shut down attempts to move laterally between unauthorised systems.
Monitoring
privileged activity
Whether
it’s a trusted insider who wandered into the wrong area or an attacker with
malicious intent, there’s a very good chance that at some point users will gain
access they shouldn’t have.
The
challenge, then, is to improve visibility and forensics around user activity
within sensitive systems. To deter violations at this late stage of the kill
chain, you must:
•
Ensure that all privileged access and activity is attributed to a specific
user.
•
Monitor all privileged activity to proactively detect unusual behaviour and
trigger automatic mitigations.
•
Record all user sessions so that all privileged activities can be played back
in DVR-like fashion.
•
Review and certify privileged access on a periodic basis to ensure that it is
still required.
