September 2020

In 2020, needless to mention, IT security has faced a dreadful, apprehensive and uncertain future, thanks to the recent pandemic and extensive adoption of Work From Home (WFH) culture. To build a robust cyber resilience, organizations are toiling hard to cope with the newest emerging IT security threats. Apart from the existing threats like phishing, ransomware, Man-in-the-Middle attack, DDoS attack or even Zero-day threats, the major threat of data theft by compromising privileged accounts has topped the list. Almost 72% of organizations have agreed that the security of privileged accounts is their major area of concern while trying to protect their vast data assets from unauthorized and malicious users.

The sanctity of data security depends on the preparedness of organizations in areas of centralized policy, access control management, real-time monitoring of the users, robust password management and more. Hence, we are witnessing the fast-adoption of PAM.

However, deployment of an enterprise-class Privileged Access Management (PAM) is never an easy task. Enterprises struggle to effectively implement it because a modern-day enterprise’s IT environment is complex. PAM projects get stalled or are ineffectively implemented because there is often a wide mismatch between the IT infrastructure requirements and solution offerings. Sometimes product architecture is very complex. Deploying a PAM solution becomes a nightmare when it has too many moving parts or is compatible only with let’s say windows endpoints. Again, a solution’s inability to support cloud or hybrid environments hampers scaling-up of the IT infrastructure. Implementation becomes a headache if a solution fails to seamlessly integrate with disparate IT components. Moreover, inadequate documentation, a bad user interface, or a counterintuitive administrative experience makes a PAM project a failure.

Why should your organization invest in ARCON | PAM on priority?

Here is a quick rundown of the challenges that IT security teams face while deploying PAM in their network. Additionally, we will see why more than 300 global enterprises prefer ARCON | PAM to ensure comprehensive security for their business assets.

Lucidity in accessing servers and speed: This is one of the common challenges that organizations face while deploying PAM solutions. There are many global players, who have shown discomfort about slow server access during and post-deployment of PAM. However, for ARCON | PAM, we come across opinions like, “We can access the servers very fast and time saving tools..the product is good and user friendly… we are daily using daily reboot activity around 300 servers...”
Scalability: This is another constraint for organizations while deploying PAM or renewing contracts of deployment. While scaling up the product services or features, very often organizations face an unwanted set back in terms of promptness and user-friendliness. ARCON | PAM, on the other hand, is serving the mid-size and large enterprises with a highly scalable architecture whenever required. The AVP – IT of one of our clients from the Finance industry opines, “Any kind of addition in the privileged accounts or any kind of scalability whenever required, ARCON team was prompt in action and resolved the queries and requirements in minimum time.”

Smooth Implementation, Execution and Support: The IT department of any organization is always skeptical about incorporating new technologies in their daily operations. The drastic changes in the pattern of IT threats are forcing them to seek the assistance from a robust solution that could notify the administrators about any anomaly in real-time. PAM solution is the best contender for this. However, the IT administration department spends sleepless nights when it comes to implementing a new solution for their IT ecosystem. However, a smooth implementation might not be a reality considering if the support system is bad. ARCON | PAM in this respect has won confidence from many IT professionals as we see here: “ARCON is providing fantastic support during implementation phase. Along with excellent solution design that integrates with our business requirement it helps for business growth as well. The team is very skilled and helpful”.

Customizability and Flexibility: This is another important factor which many large and mid-scale organizations look forward earnestly. On multiple occasions, it is observed that organizations prefer to customize the security solutions and services to perfectly fit into their ‘exact requirement’. While many vendors stumble upon this requirement, ARCON | PAM is a solution that is capable enough to mould the technology and features as per the ‘requirement’ and make the clients realize their value for money. One of the IT security managers from the Finance industry said, “We are using ARCOS from more than 4 years and have always seen terrific support from their back-end team in case of any customization or enhancement.”

Enhance Productivity, Performance and Compliance: This is the ultimate objective of any organization while implementing information security solutions in their IT infrastructure. ARCON | PAM never allows any kind interruption in the overall IT performance and always tries to enhance productivity with the benefits that are offered along with the solution. With this, the organizations are even able to comply with the standard global regulations. Even the analyst community speaks loud about this solution: “ARCOS Privileged Access Management Suite is very easy to manage and control on the access for IT Team, which helps for the Compliance in the Industry.”

Lastly, we would like to address that ARCON scored 3.45/ 5 for Mid-size and large enterprise use cases in Gartner 2020 report on Critical Capabilities for Privileged Access Management (PAM). Some of the key advantages of this solution are as below: (extract from the report)

ARCON offers above-average privilege task automation (PTA) functionality through its automation script manager component.
Discovery capabilities are above average, including AD, network devices, cloud, databases and some applications.
It supports high availability and load balancing approaches with its appliances and software.
It offers an encrypted email approach for a “break-glass” capability.
Application allow/ deny/ isolate approaches are available, as is file integrity monitoring.
ARCON offers smart session management, which flags access to high-risk systems, and good governance and administration through its user governance portal.
Password management for both interactive and software accounts is supported by the ARCON vault.
The logging and reporting capability is average to above average, with 90 reports out of the box.
ARCON offers well above average performance for session management.
In addition, ARCON offers a native identity analytics product called Knight Analytics, for UBA capabilities applied to PAM sessions

Disclaimer: Gartner, Critical Capabilities for Privileged Access Management, 4 August 2020, Michael Kelley, Felix Gaehtgens, Abhyuday Data
Gartner Peer Insights reviews constitute the subjective opinions of individual end users based on their own experiences and do not represent the views of Gartner or its affiliates.
Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

The sudden ‘new normal’ emerging for global organizations due to the pandemic and resulting remote work culture has increased IT security concerns, especially malicious insider threats. Inadequate transition time for adapting to the changes and insufficient IT security safeguards have made global organizations more vulnerable to insider threats and cyberattacks.

Still, implementing best practices can help ward-off IT threats emanating from the misuse of digital identities and credentials. So we thought to disseminate information around that. The stage was set. ARCON being the pioneer in Information Security solutions partnered with KuppingerCole, one of the leading Identity and Access Control advisors and consultants in the world to host a webinar.

On 2nd September 2020, ARCON jointly hosted a webinar titled: Remote Workforce: How to Protect yourself from Emerging Threats? The eminent speakers were: Mr. Paul Fisher, Senior Analyst, KuppingerCole and Mr. Anil Bhandari, Chief Mentor, ARCON.

Key Takeaways from Paul Fisher’s session
Global enterprises are busy adopting the remote workforce – the ‘new normal’ of IT infrastructure. In this backdrop, the cyber threats are rising exponentially and the nature of threats is also getting sophisticated. Here is a quick rundown on what Mr. Paul Fisher highlighted on the circumstantial risks of remote work conditions:

Sudden Shift of on-prem workforce to the remote workforce: Due to emergency mode, most of the organizations had to plunge into “get the job done fast” strategy where IT security might not appear on the list of priorities.

Unsecured home Wi-Fi: In Work From Home (WFH) conditions, employees manage their work using home Wi-Fi which is never 100% secured. As a result, security risks rise exponentially.

Weak VPNs or no VPNs: If the virtual private network (VPN) is poor, then the users find it difficult to securely send or receive data across the network.

Shared Common Passwords and shared files: To make the access control mechanism “hassle-free” (apparently), enterprise IT teams allocate common and shared passwords for multiple users to access critical files/ systems. As a result, monitoring the users and identifying suspicious activities becomes challenging.

Recently, the FBI reported the number of cyber incidents during the COVID 19 pandemic, which is an alarming increase of 400% compared to that of the pre-COVID era. The statistics in India is scarier with an 86% increase in cyber incidents between March to April 2020.

The cyber risks accelerate while there is a 40% increase in the usage of the internet across the globe as employees access critical applications, systems or files remotely. In this regard, enterprise-connected devices are more prone to threats.

There is an abrupt rise of 22% of security vulnerabilities across global enterprise networks in the first half of 2020 compared to the second half of 2019.

While explaining the must-haves for cybersecurity, Multi-factor Authentication, Endpoint Protection, Patch Management, Data Protection and Frequent Security Training topped the list to combat the emerging IT security risks in remote work conditions.

The six basic rules for the betterment of cybersecurity are a good sense of security where the instant realization of malicious activities is important. There should be sound knowledge and a thorough understanding of the suspicious links/ emails and safe links. The strong authentication mechanism of the users for accessing business-critical applications or systems bridges the gap between requirement and security. In addition, verification of the email sender especially when it seems to be suspicious in nature through another medium (phone calls) is highly recommended.

Privileged Access Management – An Overview

Key Takeaways from Anil Bhandari’s session
At a time when remote access has become the ‘new normal’ of the digital workspace, organizations have started to treat their remote IT environment as their on-prem IT ecosystem. Confidential business data is the CORE of security and it is highly essential for the organization to know what should be secured, when to secure and how to secure. In remote conditions, while every organization is struggling to maintain business continuity, IT security occasionally takes the back seat. Here is a quick rundown of what Mr. Anil Bhandari has highlighted the USPs of ARCON | Privileged Access Management (PAM) & ARCON | User Behaviour Analytics (UBA) that can walk in-line with the requirement of remote work environment:

Work From Home (WFH) practice has necessitated the implementation of secured remote accesses to business-critical applications and systems. Organizations require a robust IT security mechanism to manage, control, monitor remote access and the IT risk management team is more agile in establishing trustworthiness.

During the pandemic, organizations had to spend thousands on laptops and are struggling to overcome various access challenges such as limited access licenses, slow access, user access permissions, critical data access, privileged access, just-in-time access etc. As a result, the “High-Friction Low-Security” methodology has taken the front seat with a lot of daily IT operations challenges across the enterprise network.

High digital investments were discussed where business models, business modules and overall IT security are taking a different turn. With outcome-based models, organizations are more inclined towards user behaviour centric security rather than conventional device-centric security. In the age of automation, monitoring the users and their activities is drawing more attention rather than just preventing them from accessing business-critical applications or systems.

The entire world is getting inclined towards an automated IT security model where the users, privileged users, super admins – all are monitored in real-time and their access to critical systems is time-bound.

The most interesting model of IT security today is an outcome-based model where organizations get inclined more towards a fruitful result than just deploying a traditional security mechanism. For instance, in banks, we no longer deposit our money just to keep it safe, we calculate and check out the amount of return we can get from just depositing it for a certain period. Another interesting use case is from the education industry where the students are more targeted as per their skills and key expertise rather than just providing general education to one and all.

“Low-friction High-Security” methodology has become the need of the hour due to WFH scenarios across the globe. The entire world is working on virtual access where people are working remotely, earning from home and students are learning from virtual classrooms. In this backdrop, as ARCON experienced with most of its customers, unsecure VPN access, slow internet, IT security remains the major area of concern.

In the virtual world, Low-friction is a necessity today. We are dwelling in an era where high-security is prioritized by any and every organization everywhere. Low-Friction ideally means the ability of the end-users or rather the daily IT operations team to have an experiential outcome whatever application or critical systems they access inside the organization very seamlessly. That would raise productivity towards a high level with a robust IT security. ARCON is a brand with advanced risk-preventive solutions always improvises on the solution features according to this “Low-friction and High-security” model.

The conventional controlled access suggests end-users to be on software applications and super-users on software Apps. The attackers always try to gain access to super-user passwords because super users provide complete control of the critical systems.

Keeping the demand for Zero Trust security infrastructure in mind, ARCON’s security solutions (Privileged Access Management) are always a step ahead with the robustness of risk-predictive mechanisms rather than risk-preventive ones. The Predict | Protect | Prevent model of ARCON enables us to build a Zero Trust framework around privileged identities.

Lastly, ARCON | User Behaviour Analytics (UBA) is an essential tool to detect anomalous activities in WFH conditions. While large amounts of enterprise data is accessed by end-users from different network zones and geographies, organizations count a lot on an engine that can seamlessly monitor individual user activities and notify the administrators about anything suspicious. ARCON | UBA meets all the requirements of predictive user-behavioural security.

In the times to come, keep posted because ARCON would be conducting more webinars that would focus on several relevant industry use cases and discuss how the risk-predictive technologies can mitigate security threats arising from unprecedented cyber-threats.

ARCON is a leading enterprise risk control solutions provider, specializing in risk-predictive technologies. ARCON | User Behaviour Analytics enables to monitor end-user activities in real time. ARCON | Privileged Access Management reinforces access control and mitigates data breach threats. ARCON | Secure Compliance Management is a vulnerability assessment tool.

Products

Solutions

Services

Resources

Company

Month: September 2020

Implementing PAM: Major Aspects to keep in mind

The meticulous IT practices amid emerging challenges from remote workforce