Month: April 2021

Introduction

 Privileged Access Management (PAM) is a mechanism that securely manages and controls the privileged users. These users have elevated rights to access the critical IT resources, which could be databases, cloud resources, business applications among many more.

Privileged IDs, login credentials created for privileged users, are high-value targets for cyber criminals since these are the gateways to the most confidential assets of an organization. That’s why a robust Privileged Access Management is a must for organizations.

However, there are several loopholes in IT practices that are less-discussed and could impact the overall security of privileged accounts.

Here are ten major mistakes that prevail in enterprise IT environments due to which organizations can be a target of malicious insiders.

1. No Multi-factor Authentication: Multi-factor Authentication (MFA) of Privileged Access Management is an essential component of modern identity and access management. The general thumb rule of a robust end-user authentication is more layers between request and access. It gives more security to the data assets. A single layer of authentication becomes easy for the hackers to circumvent the authentication process. To breach the passwords, the hackers take help of multiple tools like phishing, social engineering, etc. to steal critical data.
2. Management of Service IDs: In an enterprise IT infrastructure, there are service IDs, and Privileged IDs, that possess individual importance. In special scenarios, the IT admin requires the Privileged IDs, that are accessed and controlled by PAM, to be integrated with other root IDs that could have equivalent privileged rights. This happens only because of the convenience of the user to login repeatedly for every assigned task. However, it invites and increases malicious activities. Thus, we should avoid duplicacy of credentials and access rights.
3. Server Hardening: If a PAM server is not hardened as per Computerized Information System (CIS) policies, then there are security risks. CIS is a computer hardware and software system that collects and processes data and disseminates information throughout the organization. Hence, if the policies are not matched, the security risk increases exponentially.
4. Default TCP (Transmission Control Protocol) Port: For any enterprise IT environment, the SQL Server is hardly recommended for highly critical IT tasks like database management. Instead, organizations prefer customized server access routed through PAM so that the IT risk assessment team can track and control the number of accesses, time of access and duration of logs. Also, to understand and keep a track of the number of ports, it is recommended having customized servers.
5. Absence of HANDR (High Availability and Disaster Recovery): Like in real life, it is always wise to have alternatives in IT as well. In the Privileged Access Management (PAM) solution, there are two modes of mechanisms: primary and secondary modes. During any IT disaster, if the primary mode stops working, then the secondary mode takes the charge so that the business operations of the organization don’t hamper. Hence, dual-mode PAM solution is highly required in the DR sight of the organization. Absence of HANDR might not prevent organizations from unprecedented IT security circumstances.
6. Valid SSL (Secure Sockets Layer) Certificate: SSL Certificates are the protocol that allows authentication, encryption or decryption of data sent over the Internet in an enterprise. Once applied, it activates the standard https// protocol and allows secure connections from a web server to a browser. PAM helps to authenticate the SSL certification and prevents malicious elements from entering the enterprise IT ecosystem.
7. Absence of Domain Authentication: PAM helps enterprise IT teams to create a separate repository of end-user credentials at granular levels. All the end-user details, end-user authorization, generation of access to the target devices are managed by PAM. It is comparatively more effective (from security perspective) rather than managing the end-users centrally where there are chances of losing the track of user activities. PAM identifies the user domain and allows access to the target systems post authentication.
8. No Detection of bypassing Outside Access: Since the IT infrastructure is expanding exponentially, organizations are forced to give access to the third party users for various tasks. If these users try to bypass the PAM authentication process, for malicious intent or simply for convenience, are blocked immediately. However, as per organizations’ preferences, instead of blocking the user, the IT team can just receive an alert of anomaly. Thus, the role of PAM becomes imperative.
9. Ignore Critical Alerts: Every critical alert should be mandatory for all the servers prevailing in the IT ecosystems. Organizations put themselves at risk by not activating alerts for all the existing servers or databases which increases IT risks.
10. Service Request Workflow: There are situations where organizations have no other options but to allow third party vendors to access critical applications and perform some scheduled tasks. For this, they require access to the application server as well. PAM helps to give temporary access to the vendor for a specific application only during a pre-defined date and time and avoid unnecessary extra time access to the servers and avoid probable malicious attempts. Once the task is completed, the access rights are revoked automatically. To know more, please refer to the Just-In-Time Privilege Whitepaper of ARCON.

Conclusion

Privileged accounts are omnipresent. They differ from other accounts in terms of elevated permissions, ability to alter access mechanism settings for a large group of users. Moreover, multiple people having access to any specific privileged account, even if temporarily, might invite unwanted and unpredictable risks that could wreak havoc on the overall IT ecosystem. The points discussed above, once implemented, could surely safeguard organizations from insider threats.