Privilege access management is one of the critical elements of user access management for every organization and building adequate controls around them is vital to keeping information/IT assets within an organization safe from both internal abuse and external attacks. Given the threat that privileged users/accounts pose to every organization if abused or misused, it is important that governance structures are put in place to control and monitor activities of privileged users in such a manner that makes them accountable to the business and disabuse their minds that they are above the organization’s policies as well as laws as always assumed. Managing privileged accounts in large organizations present even more challenging situation to IT management give the scope of their authorities in the organization information/IT assets and the impact their actions and inactions will have enterprise-wide if not checked accordingly. As such, the organization require a more central and pragmatic approach to managing, controlling as well as monitoring such access. It will obviously not be a good/best practice to manage privileged accounts in silos (i.e. local account management per endpoint) as against central management, which will be counterproductive.
One of the pitfalls of privileged access management is allowing privileged accounts to be managed in isolation/silo within each system or endpoint and as such, preventing a more central management approach. Doing so always create more problems than it solves in additional to administrative overhead associated with this practice. Silo management usually make it difficult to adminsiter/manage accounts, for example, a privileged user in a large organization who require access to say 110 servers to perform his/her duties will have to be created in each of the servers manually. When his/her access need to be modified (elevated or downgraded) or deleted in the event of exit from the organization, that will also be done manually. You can only imagine what it will take for this to be done. This obviously is not the best and efficient approach to managing the process.
Different organizations have fashioned out a more pragmatic and domesticated approach to privilege users/accounts management such that will address its unique business risk and operating challenges in addition to regulatory and legal considerations. As such, it is important for us to look at some of techniques or approaches organizations can adopted in addressing the risk associated with privileged access in their environment. Below are some of the techniques or measures that can be considered.
Laying the right foundation for governance of privileged access will be a good way to start. Organizations are expected to institute policies, frameworks and procedures that will drive processes around privilege access management as well as shape behaviours of all stakeholders in understanding their roles and responsibilities in addition to management expectations around privilege access management. Setting out policy framework around privilege access management either through the information & Cybersecurity policy or as a standalone policy will be a good way to set the tone for such practice. The policy is expected to capture who qualifies for privilege access based on their functions or need-to-do, what privileged access should be given and on what system(s) or information assets. It should also define how the access will be availed in terms of the process that will be followed to obtain such access and the lifetime of such access. It should also point out responsibilities and obligations of every privileged user in terms of ensuring the security of their access and the need to prevent abuse or compromise while consequences and accountability process in the event of abuse or compromise are clearly spelt out. The policy must be communicated to all stakeholders to ensure good awareness and understanding of responsibilities and obligations of concerned persons.
Because of the underlining assumption that human control could fail, there is need to use automated tools to check human excesses. Privilege Identity/Access Management (PIM/PAM) and Single Sign-On (SSO) solutions comes handy in managing and controlling privileged access (accounts/users). Privilege Identity Management solutions like CyberArk and Beyond Trust PAM can be deployed to provide a more central mechanism to managing privileged access. Through the PIM/PAM, administrators/privileged users' access across various technology platforms such as UNIX (IBM AIX, HP UX, Oracle/SUN UNIX), LINUX (Redhat, Centos, Kali, Ubuntu), Windows, Virtualized infrastructure (VMware-Hypervisor, EXSi Host-VShpere, Vcenter, Vblock, VxBlock, etc.), are managed centrally through the PIM/PAM such that it eliminates the need to manage such access on individual servers running operating system platforms mentioned above.
(Cybersecurity consultant, Tech Blogger & Author)
Will appreciate your questions and contributions on to post. For sponsorship, ad placement, speaking opportunity and training bookings, please Contact US or Send us an email at firstname.lastname@example.org.