{"id":2109,"date":"2020-04-06T14:05:35","date_gmt":"2020-04-06T10:05:35","guid":{"rendered":"https:\/\/techxmedia.com\/?p=2109"},"modified":"2025-04-17T23:59:21","modified_gmt":"2025-04-17T19:59:21","slug":"journey-universal-privilege-management","status":"publish","type":"post","link":"https:\/\/techxmedia.com\/en\/journey-universal-privilege-management\/","title":{"rendered":"The journey to Universal Privilege Management"},"content":{"rendered":"\n

Author: Karl Lankford, Director \u2013 Solutions Engineering, BeyondTrust<\/em><\/strong><\/p>\n\n\n\n

Almost without\nexception, today\u2019s threat actors leverage readily available automated tools \u2014\nautomation increases the speed and probability that the attacker can find and\nexploit that initial weak link that gives them a \u201chook\u201d into an environment. <\/p>\n\n\n\n

The good news is\nthat organizations increasingly recognize that to maintain a level playing\nfield, they need automation and purpose-built solutions to protect privileges,\nand PAM has become a cornerstone of an effective, modern cybersecurity defense.\nThe bad news is that many organizations mistakenly presume that privileged\npassword management alone will solve the problem, when it\u2019s only one part of a\nnecessary, comprehensive PAM solution.<\/p>\n\n\n\n

Universal Privilege\nManagement (UPM)<\/strong><\/p>\n\n\n\n

The Universal\nPrivilege Management model allows enterprises to start with the PAM use cases\nthat are most urgent to the organization, and then seamlessly address remaining\nuse cases over time. Each use case, once addressed, will give enhanced control\nand accountability over the accounts, assets, users, systems, and activities\nthat comprise the privilege environment, while eliminating and mitigating\nmultiple threat vectors. The more use cases that are addressed, the more PAM\nsynergies emerge, and the more impact organizations will realize in reducing\nenterprise risk and improving operations. <\/p>\n\n\n\n

So here are the 10\nuse cases on your journey to UPM.<\/p>\n\n\n\n

Accountability <\/strong><\/p>\n\n\n\n

While not mandated,\nmany organizations find discovering and securing privileged accounts the\nlogical starting point for improving privilege security controls. But this\ndemands a privileged credential management solution that automatically\ndiscovers and onboards the ever-expanding list of privileged\naccounts\/credential types and brings those under management within a\ncentralized password safe. This includes both human (employee, vendor) and\nnon-human (functional, service, application, software robot, etc.) accounts in the\nenvironment. <\/p>\n\n\n\n

The solution should\nallow control over which accounts are being shared, by whom, when, where, and\nwhy. It should provide mechanisms to find hardcoded credentials and deliver\noptions to replace them with managed credentials. Critically, the solution\nshould monitor, manage, and audit every privileged session regardless of where\nit originates.<\/p>\n\n\n\n

Least privilege on desktops<\/strong><\/p>\n\n\n\n

Another important\nstep to achieving Universal Privilege Management is implementing least\nprivilege on end-user machines. Least privilege is defined as, \u201cthe minimum\nprivileges\/rights\/access necessary for the user or process to be fully\nproductive.\u201d <\/p>\n\n\n\n

With a\nleast-privilege approach, users receive permissions only to the systems,\napplications, and data they need for their current roles. Rather than being\nenabled, persistent, and always-on, the privileges are only elevated on an\nas-needed basis and only for the targeted application or process. This is the\nbasis for a just-in-time (JIT) PAM model. <\/p>\n\n\n\n

Least privilege on servers\n<\/strong><\/p>\n\n\n\n

Organizations must\nlimit, control, and audit who has access to superuser accounts and privileges,\nwithout impairing productivity. Organizations must be able to efficiently and\neffectively delegate server privileges without disclosing the passwords for\nroot, local, or domain administrator accounts. They should record all\nprivileged sessions to help meet regulatory compliance. This is conceptually\nlike the removal of administrative rights on desktops, but with the added\nrequirements of supporting server-class operating systems in Tier-1 regulated\nenvironments.<\/p>\n\n\n\n

Application reputation\n<\/strong><\/p>\n\n\n\n

Another application\nreputation capability involves empowering organizations to make better informed\nprivilege elevation decisions by understanding the vulnerability of an\napplication or an asset with which it interacts. Applying real-time risk\nintelligence to privilege delegation and elevation not only stops exploits from\nbecoming a privileged attack vector, but it also blocks drive-by social\nengineering threats that can leverage vulnerabilities within the environment.\nSimilar to application control on Windows, command filtering on Unix and Linux\nis a critical security, compliance, and reliability control. For both\napplication control and command filtering, a full audit trail of everything, attempted\nand allowed, is important. <\/p>\n\n\n\n

Remote access<\/strong><\/p>\n\n\n\n

The vast majority of\nremotely launched attacks come from threat actors who are not specifically\ntargeting the organization, but rather through remote contractors, vendors,\nand, even remote employees, who have themselves been compromised. <\/p>\n\n\n\n

The ideal defense is\nto extend PAM best practices beyond the perimeter. This ensures only the right\nidentity has access to the right resources in the right context. It eliminates\n\u201call or nothing\u201d remote access for vendors by implementing least-privilege\naccess to specific systems for a defined duration of time, potentially\nrequiring a chaperone when appropriate. <\/p>\n\n\n\n

Vendor credentials\nshould be managed through the solution with policies, mandating rotation or\nsingle use passwords, and utilizing credential injection in sessions so that\npasswords are never exposed to end users. <\/p>\n\n\n\n

Finally, session\nmanagement and monitoring should be enforced to audit and control all\nvendor\/remote access activity. This approach is far more secure than\ntraditional protocol routing technologies like VPN.<\/p>\n\n\n\n

Network devices and\nIoT<\/strong><\/p>\n\n\n\n

Many PAM tools lack\nthe ability to extend granular privileged access controls to non-traditional\nendpoints, such as medical or industrial-connected devices and control systems.\n<\/p>\n\n\n\n

Organizations need a\nsolution that delivers the capability of least privilege to those endpoints by\nallowing fine-grained control over the commands sent and the responses received\nover SSH sessions. This offers the ability to control the operation of\nfunctions like tab completion, restricting access to only those aspects of the\nendpoint that are appropriate for the user. Administrators and vendors can be\nconstrained within their area of responsibility without impacting their\nproductivity.<\/p>\n\n\n\n

Cloud and\nvirtualization<\/strong><\/p>\n\n\n\n

With the accelerated\nuse of virtualized data centers and cloud environments for processing, storage,\napplication hosting and development, organizations have opened new avenues for\nthreat actors to access sensitive data and cause disruption. <\/p>\n\n\n\n

From a privileged\naccess management perspective, the options to secure these assets are like\ntraditional desktops and servers as described earlier. However, here are a few\nunique privileged security use cases for the cloud:<\/p>\n\n\n\n