Traditional approaches to privileged access management are almost always inadequate
Getting a group of IT professionals to follow a new management policy might be difficult. It might be challenging for upper management to force its viewpoint on the IT department. Sometimes it’s just not possible. Most IT professionals have an autonomous mindset. Managing IT from outside the department can be challenging since management doesn’t fully comprehend all that IT staff members accomplish. If the operations manager or any other manager outside of IT comes in and declares, “We need to restrict your access,” that outsider would better have a solid case to make and be resolute in their decision.
Fundamental disagreements arise whenever management considers privileged or unrestricted access a concern while administrators assess it an everyday business practice. As a result, businesses often choose one of three alternatives:
- Send out a message that will be universally disregarded, but management has been appeased, and everyone knows.
- Use a manual approach (commonly referred to as a “firecall ID”) in which the privileged access password is written on paper, sealed in an envelope, and kept in a secure, physical place (such as a safe) under the supervision of an outside, trusted employee or management—updating the password after each usage falls to that external person.
- Develop unique strategies and regulations that lack coherence and address one issue simultaneously.
Simply inadequate is the primary strategy mentioned earlier. The second approach tries to solve the problem, but as it is essentially human-controlled, it remains prone to mistakes, loss, and malicious usage. Furthermore, this method fails when you have hundreds or hundreds of accounts available.
In local business settings, the third option can be sufficient. When only a few UNIX and Linux servers are concerned, the open-source solution sudo, for instance, solves many issues and could be adequate. However, sudo does not give a centralized control feature to administer numerous servers from a single management panel or auditing for bigger setups. (For additional info about sudo, check the section titled “The sudo project.”
Four basic policies are essential to success
It is not difficult to prevent catastrophes like the SunTrust and Nuance situations mentioned above, yet most businesses don’t. An enforced policy of quickly denying access to dismissed personnel should be a basic policy of every firm — and it’s not that difficult to implement. Simply put, these companies became caught in red tape and pointless procedures, prolonging the termination of the administrator’s rights until it was already late.
These incidents may have been easily avoided if the company had established and implemented the following four rules:
- Restrict the administrators’ privileges. Native UNIX violates the fundamental security management principle of “Trust no one” by using an “all access” approach to administrator rights. Also known as Zero Trust Architecture. It adds a new degree of order and common sense to provide administrators only what they require to execute their duties.
- When required, promptly close access. Traditionally, this meant physically escorting fired workers and contractors out of the building. Still, with so many administrators and contractors now working remotely, you need to be able to disable access to privileged access management resources promptly. One vengeful worker or subcontractor may do a lot of harm. Any computer access must be immediately terminated following sound HR policy.
- Keep tabs on and evaluate administrative actions. Many businesses have a system to monitor employee activity, but superusers are frequently left out of this monitoring. Keystrokes and activities may be recorded in real-time, and existing technology can accomplish this to produce an audit trail and notify senior management of any irregularities before any harm is done. Additionally, several systems include the option to preserve the session for later forensics study and playback.
- Secure your endpoints. Traditionally, endpoint security is addressed in silos, which results in inconsistent security policies across the enterprise and vulnerabilities. A comprehensive PAM program implements the principle of least privilege and centralized procedure for Unix/Linux, Windows desktops, macOS systems, and AD/AAD networks
