Downloaded 49 times
Uploaded byLance Peterman
Privleged Access Management
This document discusses privileged access management (PAM). PAM is defined as securing and managing privileged accounts, which hold special permissions like administrator access. The document outlines why PAM is important given recent data breaches from compromised privileged accounts. It also discusses how identity is the new security perimeter and that PAM is a collaborative effort involving technology, people and processes. Examples of PAM use cases and an adoption approach emphasizing the need for leadership support and prioritizing critical systems are also provided.
More Related Content
Similar to Privleged Access Management
Privleged Access Management
- 1. Privileged Access Management (PAM) Securingthe 21st Century Enterprise Lance Peterman
- 2. Agenda What is PAM? Industryperspective Why PAM is necessary? Identity is the New Perimeter In the News Recent Data Loss / Breaches PAM as a Program/Service The Practice Collaboration is Key Use Cases Adoption Approach/Keys to Success
- 3.
- 4. Privileged access: isdefined as any feature or facility of a multi-user information system that enables the user to override system or application controls (e.g. Administrator, Root, or similar high-level privileges) Privileged accounts hold special or extra permissions within a system, application or database and can significantly affect the organization’s business. These accounts can grant broad access to underlying business information in databases, grant “super user” privileges, or can be used by authorized individuals when elevated privileges are required to fix urgent problems. Privileged Accounts include but are not limited to Windows Administrator, UNIX root, Oracle SYS, DBA, and Firecall accounts The use of privileged accounts should be managed and the password monitored when stored digitally. Privileged account activity should be logged and traceable to a unique user. If privileged account passwords are stored in a physical location, then passwords associated with the privileged accounts should be secured and access monitored between uses. What is Privileged Access Management?
- 5. Identity is theNew Perimeter Only one security control exists today that can unequivocally determine what you are authorized to do, regardless of your location Old Model New Reality
- 6.
- 7. SC Department ofRevenue Compromise of privileged accounts resulted in 3.4m individual taxpayers and businesses losing sensitive data 1 Uber account compromised? Nope… Good taxpayers were compensated for this with…1 year of credit monitoring
- 8. Saudi Aramco 30,000 PCshad hard drives erased through compromise of a privileged account 2 Insider attack suspected, abusing privileged accounts Most common privileged account? Local admin on the user’s workstation Does your organization vary that password? http://www.infosecurity-magazine.com/view/28973/insiders-exploiting- privileged-accounts-likely-behind-saudi-aramco-attack-/
- 9. EBay Spear Phishing targeted keyIT resources Does your primary network account have privileged access? Two factor authentication…anyone?
- 10.
- 11. What does thattell us? The threat landscape is changing…DAILY “The compromise of privileged access is a key stage in 100% of all advanced attacks.” – CyberSheath Report 4/13 3 This is the critical attack vector for internal and external threats Verizon DBIR – “97% of all breaches are preventable through basic and intermediate controls.” 43% of respondents in a 2012 survey did not have a PAM practice or wasn’t sure if they did
- 12. The Practice ofPrivileged Access Management (PAM) Designed to answer: Who has access When it was used Where it was used from What was done Technology is only One part of the equation – People & Process are essential Has to be part of your governance process, not just a one off enrollment
- 13. PAM is aCollaborative Effort Key takeaways…. Make PAM part of your security DNA Ask questions about privileged access when reviewing applications & risk Educate business owners when possible Cleanup of current privileged access in all environments Define & run a new/modified process to manage access (Grant, revoke, manage exceptions. All aligned with policy) Integrate the new model with Enterprise IT Processes
- 14. Sample of SomePAM Use Cases
- 15. Other PAM UseCases Script/batch management Local workstation admin management Cloud infrastructure, SaaS accounts Virtualization platforms Look at ALL hardware platforms
- 16. Adoption Approach Pre-Engagement -business area • Inventory of privileged accounts & their use • Documentation of access processes (if available) • List of candidate systems • Prioritization of critical systems based on key criteria • Regulatory constraints • Data Type (PII / IPSI) • Create/Revise access processes
- 17. Adoption Approach Engagement/Onboarding -PAM team and business area • Review inventory & target systems • Setup schedule for deployment • Test – Verify results • Update business processes • Deploy into production
- 18. Keys to Success Faulttolerance (MUST be redundant) Adoption MUST have senior leadership support & driven by policy Process First Approach, then focus on tooling Be creative, one size does not fit all When selecting a vendor, consider cloud implications Eat your own dog food first Don’t think you’re too small for this…
- 19.
- 20.