Strategies for Successfully Managing Privileged Access in Large Enterprise

Privilege access management is one of the critical elements of user access management for every organization and building adequate controls around them is vital to keeping information/IT assets within an organization safe from both internal abuse and external attacks. Given the threat that privileged users/accounts pose to every organization if abused or misused, it is important that governance structures are put in place to control and monitor activities of privileged users in such a manner that makes them accountable to the business and disabuse their minds that they are above the organization’s policies as well as laws as always assumed. Managing privileged accounts in large organizations present even more challenging situation to IT management give the scope of their authorities in the organization information/IT assets and the impact their actions and inactions will have enterprise-wide if not checked accordingly. As such, the organization require a more central and pragmatic approach to managing, controlling as well as monitoring such access. It will obviously not be a good/best practice to manage privileged accounts in silos (i.e. local account management per endpoint) as against central management, which will be counterproductive.

One of the pitfalls of privileged access management is allowing privileged accounts to be managed in isolation/silo within each system or endpoint and as such, preventing a more central management approach. Doing so always create more problems than it solves in additional to administrative overhead associated with this practice. Silo management usually make it difficult to adminsiter/manage accounts, for example, a privileged user in a large organization who require access to say 110 servers to perform his/her duties will have to be created in each of the servers manually. When his/her access need to be modified (elevated or downgraded) or deleted in the event of exit from the organization, that will also be done manually. You can only imagine what it will take for this to be done. This obviously is not the best and efficient approach to managing the process.

Different organizations have fashioned out a more pragmatic and domesticated approach to privilege users/accounts management such that will address its unique business risk and operating challenges in addition to regulatory and legal considerations. As such, it is important for us to look at some of techniques or approaches organizations can adopted in addressing the risk associated with privileged access in their environment. Below are some of the techniques or measures that can be considered.

 

Policy framework around privileged access

Laying the right foundation for governance of privileged access will be a good way to start. Organizations are expected to institute policies, frameworks and procedures that will drive processes around privilege access management as well as shape behaviours of all stakeholders in understanding their roles and responsibilities in addition to management expectations around privilege access management. Setting out policy framework around privilege access management either through the information & Cybersecurity policy or as a standalone policy will be a good way to set the tone for such practice. The policy is expected to capture who qualifies for privilege access based on their functions or need-to-do, what privileged access should be given and on what system(s) or information assets. It should also define how the access will be availed in terms of the process that will be followed to obtain such access and the lifetime of such access. It should also point out responsibilities and obligations of every privileged user in terms of ensuring the security of their access and the need to prevent abuse or compromise while consequences and accountability process in the event of abuse or compromise are clearly spelt out. The policy must be communicated to all stakeholders to ensure good awareness and understanding of responsibilities and obligations of concerned persons.

 

Privilege Identity/Access Management (PIM/PAM) Solutions

Because of the underlining assumption that human control could fail, there is need to use automated tools to check human excesses. Privilege Identity/Access Management (PIM/PAM) and Single Sign-On (SSO) solutions comes handy in managing and controlling privileged access (accounts/users). Privilege Identity Management solutions like CyberArk and Beyond Trust PAM can be deployed to provide a more central mechanism to managing privileged access. Through the PIM/PAM, administrators/privileged users' access across various technology platforms such as UNIX (IBM AIX, HP UX, Oracle/SUN UNIX), LINUX (Redhat, Centos, Kali, Ubuntu), Windows, Virtualized infrastructure (VMware-Hypervisor, EXSi Host-VShpere, Vcenter, Vblock, VxBlock, etc.), are managed centrally through the PIM/PAM such that it eliminates the need to manage such access on individual servers running operating system platforms mentioned above.

For example, for the root account in UNIX operating system, the functions/privileges of root account can be managed on the privileged identity/access management (PIM/PAM) through its agents installed in each of the UNIX servers to be managed. Doing so will reduce administrative overhead/manpower cost of having to administer root account on individual servers and as such, prevent silo administration of root access. This obviously will improve the performance and productivity of the staff involved with these functions. It will also improve password management and password policy enforcement in addition to audit trail (logs) management on each server to provide visibility on the activities of the root user on the servers such as SU (switch user) and SUDO functions as well as file/directory permissions, which have the capability of compromising other accounts arising from administrative abuse. This will also be applicable for Windows infrastructures where local default admin account e.g. “Administrator” as well as “Administrators” group account is used for privileged access on Windows. PIM/PAM also ensures segregation of duties between the platform (OS) administrators and PIM/PAM administrators. This is a situation where the administrators/privileged users on the OS platforms will not be the ones also administering the PIM solution. In other words, the person or team that administer or manage the PIM will not have any business/access in the platforms/OS that PIM controls its users access. Doing so entrenches segregation of duties and allows for transparency in the privilege access management process. This will prevent privileged users from destroying trails of their activities (e.g. deleting or modify log files) stored in the PIM solution as against when they are keep within the servers where they (administrators) have access to do and undo.

Single Sign-On (SSO) Solution

On the other hand, the Single Sign-On (SSO) solution such as Windows LDAP Active Directory (AD) is another mechanism that present a robust means of controlling and administering privileged access around Windows infrastructures/systems. Domain or enterprise Admins groups or container(s) can be created on the AD and have users who have need for such elevated/privileged access added to the containers to enable them to discharge their duties across the enterprise. This will provide an easy and more effective means of controlling and managing access as well as enforcing enterprise rules/policies across the organization using group policies objects/services available in the active directory infrastructure.

For example, when staff exit from the organization or are redeployed to other functions within the organization, their access can be disabled/deactivated or moved centrally thereby preventing them from having access on endpoints (servers, devices and workstations) where they had access. The equivalent of PIM/PAM or SSO/AD for network environment/infrastructure will be TACACS+ and RADIUS technology provided by Cisco (i.e. ACS device). Through authentication, authorization and accounting (AAA) protocol, ACS manages and controls access to the devices using strong authentication protocols like SSH, https, SHA1/MD5, etc.

 

Managing access for 3rd Party Vendors

Managing, controlling and monitoring access by 3rd party vendors can be quite challenging if it is not approached using the right measure. Such access can be looked at from two different angles;
  • Where the vendor will have to access systems within the enterprise (On-Premise or On-site access),
  • Or
  • Where the vendor will be accessing systems or resources remotely.

For on-site access, 3rd party vendor access can be controlled and managed using PIM/PAM or SSO/AD tools mentioned to restrict their access based on the need-to-do basis. Containers with defined privileges can be created on the AD or PIM and assign to 3rd party vendors who will be working on-site. Such access will restrict them to only things that they need or approved to perform their duties and nothing more. Where additional access/privileges are required, a formal IT service request ticket is raised, and such access goes through defined authorization process before they are granted. For remote access over the internet, 3rd party vendors can be made to access systems remotely through a Virtual private network (VPN) connection over the organization's frontend/internet firewall. Doing so will require some access list rules to be created on the firewall to define who can use the VPN access and what systems and services they can access and through what ports. Of course, such access will mandate authentication of the vendor employees in addition to provision of additional layer of authentication such as token or one-time password (OTP) also known as multifactor authentication (MFA). Where the vendor is required to provide remote support for an organization, an option of using remote access/control software such as Teamviewer, Dameware, Remote VNC and other tools could be considered for use if the organization’s acceptable use of information assets policy permits such usage. It is important to note the potential risk and vulnerabilities associated with remote access/control software to be sure it is a risk the organization want to take. Security information and event management (SIEM) tools such as Arcsight used for log management and event correlation can be deployed to filter and track 3rd party vendors’ access internally on the AD, ACS or PIM/PAM solution or through VPN over the internet to ensure visibility of their activities and escalate to the security operation center (SOC) or security team for activities that match certain defined rules.
 

Nwabueze Ohia

(Cybersecurity consultant, Tech Blogger & Author)

Will appreciate your questions and contributions on to post. For sponsorship, ad placement, speaking opportunity and training bookings, please Contact US or Send us an email at info@oxleyconsults.com.ng.



Back To Information and Cyber Security Jobs

Learn More About Our Valuable IT Audit Programs/Checklists

Learn More About Our Valuable Risk Assessment &Templates & Checklist

Learn More About Leading Practices in Internal Audit Function

Popular Articles

Investing in Information Technology is pivotal to the success of a business and realization of enterprise goals/objectives. To create value for the business using IT.Learn More
Fintech applications such as Online Banking has disrupted the traditional "brick and mortar" banking that we all have been accustomed to over the years. Online Banking application brought about easyLearn More
Protecting Automated Teller Machine (ATM) network end-to-end requires layered approach to security (implementing security at ATM endpoints, physical and logical network)Learn More
Audit management software are used to automate the process of auditing. Most standardized audit management software come handy with good audit process automation....Learn More
The 21st century as the information/digital age has presented numerous challenges and opportunities for humanity. From widespread industrial revolution to notable advances in IT.Learn More
The Central Bank of Nigeria (CBN) recently issued a revised circular on the regulatory framework for Unstructured Supplementary Service Data (USSD) for financialLearn More
The series attempted to answer most of the governance and management questions/concerns and how IT Governance and Management Questions are mapped to COBIT 5 Enterprise GoalsLearn More
Cloud computing is the practice of using network of remote computing infrastructures hosted on the Internet to store, manage, and process data for end users....Learn More
Remote access software are tools used to access or take full control of computing systems from a remote location either to provide support, access files...Learn More
Cybersecurity threats and attacks are a real-world problem today with thousands of organizational networks and web facing applications being compromised dailyLearn More
Mobile hacking is an exciting field for cybersecurity enthusiast and at the same time lucrative for hackers. This is given significant rise in the number of mobileLearn More

IT Audit, IT Risk and Cyber Security eBooks By Nwabueze Ohia

Auditing Your Information Systems and IT infrastructure: Practical Audit Programs/Checklists for Internal AuditorsGet Now
IT Infrastructure Risk & Vulnerability Library: A Consolidated Register of Operational & Technology Infrastructure Vulnerabilities for IT Assurance ProfessionalsGet Now
Auditing Your Payment Cards Processes, Systems and Applications: A Step By Step PCIDSS Compliance Audit Program For Brands, Issuers, Acquirers, ProcessorsGet Now
Auditing Your Windows Infrastructure, Intranet And Internet Security: A Practical Audit Program for Assurance ProfessionalsGet Now

 

Let us know your thoughts post. Leave a Comment below.