Privileged Identity Management

You have security firewalls and antivirus tools. You have role-based access controls and identity management software. You probably even have regulatory compliant applications.

But how safe are the servers, storage devices, and network appliances that actually host your data? At this moment can any administrator login to your systems, read and modify records, change device settings, install new code… and more? If there's a breach, will you know who is responsible? How will you track who did what to which system, and when?

Without a method for managing the privileged identities for every system in your network, you're vulnerable to all of these threats posed by unauthorized users and malicious programs.

What are Privileged Identities?

Privileged identities are accounts that hold elevated permission to access files, install and run programs, and change configuration settings. They exist on virtually every server and desktop operating system, business application, database, Web service, and network appliance in your organization.

The ability to manage the accounts that allow privileged access – whether called privileged account password management (PAPM), privileged user password management (PUPM), or shared account password management (SAPM) – is a subset of the broader Identity and Access Management (IAM) category. However, conventional IAM solutions are designed to manage typical end-user account activities (such as provisioning and de-provisioning users, managing login activity, and granting single sign-on rights) and cannot discover or control privileged identities.

What Are the Risks of Unsecured Privileged Accounts?

Because large organizations have thousands of privileged accounts in use throughout the IT infrastructure, it can be virtually impossible to manually track and update them all. In the absence of automated processes, IT staff often set privileged credentials to the same common, unchanging password or may update the credentials through ad-hoc scripts and group policy changes.

An organization that does not maintain frequently-changed, unique passwords for all of its privileged accounts faces the threat of unauthorized users and malicious programs compromising just one password and gaining unrestricted access to resources throughout the network. Former employees familiar with the privileged passwords at their previous organizations and malware that exploits common privileged account passwords pose a particular threat.

Manual processes to change privileged account passwords also pose risks, since improperly implemented and incomplete password updates can result in account lockouts, cascading system failures, and extended IT service disruptions.

The lack of adequate policies and practices to manage privileged accounts can make an organization unable to:

• Address its security risks by locating all potential privileged account vulnerabilities
• Protect its access by verifying that sensitive data is only accessible to authorized users
• Verify security by providing an audit trail of individuals who are granted access to sensitive data
• Reduce the potential for extended damage after a security breach exposes privileged credentials that can be re-used across independent IT assets
• Eliminate undesired system changes and service disruptions when privileged accounts are used for tasks that don’t require them

Who Has Privileged Access?

Privileged identities are widespread in the IT infrastructure, since they can be found on server and desktop operating systems, on hardware devices like routers or switches, and on applications and services like databases, backup programs, scheduled tasks, and more. Unauthorized access to the privileged account passwords on any of these resources can lead to a compromise of sensitive corporate data and disruptions to IT services.

Without proper controls, access to an organization’s privileged accounts spreads over time, often in unplanned ways. This happens as organizations:

• Fail to change the pre-configured logins and service accounts that are introduced as they deploy new hardware and applications
• Delegate administrative duties across overlapping groups, change the roles of IT administrators, or contract IT jobs to outside personnel
• Fail to revoke all privileged accounts accessed by an employee after his or her job changes or employment ends
• Are breached by social engineering, dictionary attacks, or other means

Privileged Identities and Regulatory Compliance

Inadequate controls over privileged account access can lead to compliance failures with mandates like PCI DSS, Sarbanes-Oxley, HIPAA, NERC and others. The specific demands of each regulation differ, but all share common requirements to:

• Change vendor-supplied privileged password defaults
  
• Restrict access to least privilege required for a task
  
• Immediately revoke access for terminated users
  
• Disable inactive privileged accounts
  
• Avoid group, shared, or generic passwords
  
• Implement automated audit trails

When organizations fail to comply with regulatory mandates they face stiff fines, loss of access to crediting agencies, negative publicity, and similar outcomes. For this reason organizations that effectively control their privileged identities not only eliminate the uncertainty of IT compliance audits, but also reduce their business risk as a whole.

Taking Control of Privileged Identities

Despite the serious security risks and the potential for IT compliance audit failure, many organizations are unaware of their own vulnerabilities when it comes to privileged accounts.

Consider the case of a large U.S. bank whose privileged accounts went unmanaged until its personnel discovered that a fired IT administrator had published the organization's privileged account passwords on the Internet. Fortunately the organization purchased and installed Lieberman Software products the day that the incident was discovered. Once installed, the software allowed the bank to quickly find, update and continuously secure its privileged passwords on every server, database and line-of-business application. This prevented a security breach and ensured that the organization would not face a similar crisis again.

Lieberman Software products help organizations control privileged account access through a four-part I.D.E.A. process:

• Identify and document all critical IT assets, their privileged accounts and their interdependencies.
• Delegate access to privileged credentials so that only appropriate personnel, using the least privilege required, can login to IT assets.
• Enforce rules for password complexity, diversity and change frequency, and synchronize changes across all dependencies.
• Audit and alert so that the requester, purpose, and duration of each privileged access request is documented

To learn more download the white paper “Who Holds the Keys to Your IT Kingdom? Four Key Steps to Securing Privileged Identities” or contact us to arrange a free product evaluation.