Download as PDF, PPTX
Uploaded byBeyondTrust
Sudo Mode (part 2): How Privilege Mistakes could Dismantle your Entire Enterprise
This document discusses the importance of the 'sudo' command in managing user privileges in Unix and Linux systems, highlighting its role in delegating authority, providing an audit trail, and the potential risks of misconfigured privileges. It also introduces the PowerBroker Privileged Access Management Platform, which offers comprehensive solutions for privilege management, auditing, and compliance. Additionally, it emphasizes the necessity of file integrity monitoring to ensure that elevated processes remain uncompromised.
More Related Content
Similar to Sudo Mode (part 2): How Privilege Mistakes could Dismantle your Entire Enterprise
Sudo Mode (part 2): How Privilege Mistakes could Dismantle your Entire Enterprise
- 1. The Sudo ModePart 2: How Privilege Mistakes Could Dismantle Your Entire Enterprise @paulacqure @CQUREAcademy CONSULTING Krystian Zieja CQURE: Security & Infrastructure Expert CQURE Academy: Trainer Email: Krystian@cqure.pl
- 2.
- 3. What is SUDO? Whatsudo do: delegate authority run commands as root or other user providing an audit trail of the commands (accountability) record user session prevent password sharing
- 4. Sudo: How itworks? User submits a command via sudo i.e. sudo systemctl restart httpd sudo program checks /etc/sudoers file If user is allowed to use sudo, sudo program executes the command
- 5. Sudoers file Who Where(on which system) Run As (user:group) Command and parameters operators ALL NOPASSWD ALL John sys1 printopr PRINTING %helpdesk all ALL /usr/bin/add user
- 6. Restrict your sudoers:Just required privileges
- 7. One to rulethem all: distribute sudoers file
- 8. Local Rules Files #includedir/etc/sudoers.d It’s not a comment
- 9. Become another user:sudo not as a root
- 10. Glob pattern: dangerwildcard in path
- 11. Securely edit files:How to prevent shell escape?
- 12. Prevent su command:enforce accountability
- 13. Tracing with sudo:grab all input and output
- 14. Sudoreplay: search, replay,watch and relax
- 15. PowerBroker for Unix andLinux Comprehensive Unix & Linux Privilege and Session Management to Protect Your Most Critical Systems
- 16. Endpoint Privilege Management Remove excessiveuser privileges and control applications on endpoints WINDOWS | MAC Enterprise Password Security Provide accountability and control over privileged credentials and sessions APPS | DATABASES | DEVICES SSH KEYS | CLOUD | VIRTUAL Server Privilege Management Control, audit and simplify access for DevOps and business-critical systems UNIX | LINUX | WINDOWS ASSET & ACCOUNT DISCOVERY THREAT & VULNERABILITY INTELLIGENCE & BEHAVIORAL ANALYTICS REPORTING & CONNECTORS POLICY & ACTION RESPONSE THE POWERBROKER PRIVILEGED ACCESS MANAGEMENT PLATFORM BeyondInsight
- 17. PowerBroker for Unix& Linux: • Eliminates the sharing of privileged credentials and delegate permissions without exposing credentials • Tracks, logs and audits activities performed on Unix and Linux systems for compliance • System level control provides powerful file and folder controls, not just command line analysis
- 18. Is Sudo Enough? Logsare not tamper-proof -> You can’t prove compliance beyond just a checkbox No official support or QA testing -> If it’s hacked, there is no one there to help Complex to manage on multiple hosts -> Inconsistency leads to gaps, and gaps lead to risk of exploit or misuse
- 19. PowerBroker for Unix& Linux Dynamic Access Policy Fine-Grained Least Privilege Privileged Threat Analytics Remote System & Application Control Auditing & Governance File & Policy Integrity Monitoring Privilege Management Best Practices Privilege management solution that helps security and IT organizations achieve compliance, control privileged access, and prevent and contain breaches • Monitor and audit sessions • Reduce attack surfaces • Analyze behavior • Centralize policy, management and reporting
- 20. Centralized by Design PowerBrokerfor Unix & Linux was designed to operate centrally from day one. With all the controls and audit data being centrally accessible even under the most extreme load. Highly flexible, infinitely granular, yet simple to use: • Centralized Policies • Centralized Logs • Centralized Session Recordings • Remote Host Control • Powerful Policy Language • High Availability and Highly Scalable
- 21. Advanced Control andAudit PowerBroker for Unix & Linux controls access to files at the system level, not at the command level. This provides advanced capabilities such as: • Auditing activities inside scripts • Controlling file and folder access, even for root • Block malicious and tampered binaries
- 22. File Integrity Monitoring Acritical part of Privilege Management is making sure that the ‘things’ you allow to be elevated, and the processes that perform the elevation, have not been compromised. As such, File Integrity Monitoring is a must for all organizations: • Centralized Management • Built-in to PAM Solution • Target Files and/or Folders • Track target changes on: Name Location File Size Date and Time Ownership Hash Permissions Policy Violations
- 23. Detailed Forensics andReporting • Searchable Index • Scheduled Reports • Custom Reporting • Single Events Window
- 24. How Does itWork?
- 25.
- 26. Quick Poll +Q&A Thank you for attending!