Strategies for Successfully Managing Privileged Access in Large Enterprise

Privilege access management (PAM) is one of the critical elements of user access management for every organization while building adequate controls around PAM is vital to keeping information assets within an organization safe from both internal abuse and external attacks. Given the threat posed by privileged users/accounts to every organization, it is important that necessary governance structures are put in place to control and monitor activities of privileged users in such a manner that makes them accountable to the business and disabuse their minds that they are above the organization’s policies as well as laws as usually assumed. Managing privileged accounts in large organizations present even more challenges to IT service management given the scope of their authority over organizational information assets and the impact their actions and inactions could have enterprise-wide if adequate checks are not not put in place. As such, the organization require a more central and pragmatic approach to managing, controlling as well as monitoring privileged user access. It will obviously not be a good/best practice to manage privileged accounts in silos (i.e. local account management per endpoint) as against central management. Doing so will be counterprodcutive as it will not afford the organization the opportunity to have an enterprise-wide approach to security and good practice.

One of the pitfalls of privileged access management is allowing privileged accounts to be managed in isolation/silo within each system or endpoint and as such, preventing a more central management approach. Doing so always create more problems than it solves, in additional to administrative overhead associated with such practice. Silo management usually make it difficult to adminsiter/manage accounts, for example, a privileged user in a large organization who require access to say 110 servers to perform his/her duties will have to be created in each of the servers manually if no central approach is adopted. When his/her access need to be modified (elevated or downgraded) or deleted in the event of exit from the organization, that will also be done manually. You can only imagine what it will take for this to be done. This obviously is not the best and most efficient approach to managing such process.

Different organizations have fashioned out a more pragmatic and domesticated approach to privilege users/accounts management such that will address its unique business risk and operating challenges in addition to regulatory and legal considerations. As such, it is important for us to look at some of techniques or approaches organizations can adopted in addressing the risk associated with privileged access in their environment. Below are some of the techniques or measures that can be considered.

Laying the right foundation for governance of privileged access will be a good way to start. Organizations are expected to institute policies, frameworks and procedures that will drive processes around privilege access management (PAM) as well as shape behaviours of all stakeholders in understanding their roles, responsibilities and management expectations around privilege access management. Setting out policy framework around privilege access management either through the information & Cybersecurity policy or as a standalone policy will be a good way to set the "tone at the top" for such practice. The policy is expected to capture the criteria for privileged access including who qualifies for privilege access based on functions or need-to-do, what privileged access should be given and on what system(s) or information assets, the extent of background checks that should be conducted on such individual and the frequency of such checks were appliable. It should also define how the access will be availed in terms of the process that will be followed to obtain such access and the lifetime of such access. It points out responsibilities and obligations of every privileged user in terms of ensuring the security/confidentiality of their access and the need to prevent abuse or compromise while consequences and accountability process in the event of abuse or compromise are clearly spelt out. The policy must be communicated to all stakeholders to ensure good awareness and understanding of responsibilities and obligations of concerned persons.

Because of the underlining assumption that human control could fail, there is need to use automated tools to check human excesses. Privilege Identity/Access Management (PIM/PAM) and Single Sign-On (SSO) solutions comes handy in managing and controlling privileged access (accounts/users). Privilege Identity Management solutions like CyberArk or Beyond Trust PAM can be deployed to provide a more central mechanism to managing privileged access. Through the PIM/PAM, administrators/privileged users' access across various technology platforms/operating systems such as UNIX (IBM AIX, HP UX, Oracle/Solaris), LINUX (Redhat, Centos, Kali, Ubuntu), Windows, Virtualized infrastructure (VMware-Hypervisor, EXSi Host-VShpere, Vcenter, Vblock, VxBlock, etc.), are managed centrally through the PIM/PAM such that it eliminates the need to manage such access on individual systems running different operating system platforms.

• Where the vendor will have to access systems within the enterprise (On-Premise or On-site access),
Or
• Where the vendor will be accessing systems or resources remotely.