Month: May 2022

An overview

A rapid adoption of multi-cloud platforms among global enterprises is changing the Identity and Access Management (IAM/ IDAM) fabric including the identity governance and entitlement policies. 

Indeed, nowadays, almost three out of four businesses adopt multi-cloud platforms. It helps enterprises to meet the requirements arising from increasing daily IT computational, operational and infrastructure use cases through various cloud platforms such as the AWS, Azure and Google Cloud. 

The question is how to effectively and securely govern the identities and access control mechanisms across these multi-cloud environments. It is not just the human identities that need to be protected but machine identities/non-human identities (devices and cloud workloads such as scripts, containers, VMs, CI/CD tools, RPA tools) have to be controlled and governed. 

With hundreds or thousands of human and non-human (digital) identities accessing cloud resources, consoles, and workloads for day-to-day use cases, the emerging IT security challenges have left enterprises open to the data breach risks. 

The third party risks and insider threats have increased significantly even as the costs of data breach, non-compliance penalties (FEDRAMP, GDPR, SOC 2 among many others), cyber espionage, and even human error can be unfathomable. 

Why is Identity Governance necessary in multi-cloud environments?

As cloud infrastructure scales up everywhere, organizations are facing new challenges in cloud identity management. It is practically impossible to manage the growing number of identities of both end-users and service providers manually. 

In typical scenarios, it is quite common to see multiple cloud consoles with thousands of machine identities, and end-user identities. The threat surface, as a result, expands exponentially due to lack of access controls. 

Moreover, each cloud console has its own policy definitions for access control. As a result, it becomes a humongous challenge for the IT security staff to manage, monitor and control the increasing number of identities in the multi-cloud setup. 

In many cases, enterprises end up creating several over privileged identities or privileged cloud entitlements that are never revoked due to the lack of IT visibility. Managing  multiple cloud consoles increases administrative challenges. In other words, there is no single interface to administer the cloud entitlements spread across many cloud platforms. 

How does it ensure security?

To successfully manage the multi-cloud posture, strong identity governance (discovery of users and machines with privileged entitlements, assigning entitlements, policy definitions) with seamless monitoring through a centralized access control interface, and restrictions of any-time access to the cloud console is highly imperative. Equally important is to have  strong password management policies for users along with Just-In-Time access to tokens, keys and certificates for ensuring secure access to secrets and DevOps tools. 

How does ARCON help in Reinforcing Cloud Entitlement Governance?

ARCON offers a highly effective cloud entitlements management and governance platform, ARCON | Cloud Governance to build a robust security framework in multi-cloud platforms. 

The solution provides a centralized platform to manage, monitor and control the increasing number of identities spread across multiple platforms. It ensures complete visibility over every end-user and non-human identity access. Besides, it discovers all privileged identities in the cloud environments and controls entitlements as per the policies.  

In a nutshell, the solution empowers IT administrators and enterprise security staff to have comprehensive control over the entitlements and workloads in both single and multi-cloud instances. 

The over privileged users with excessive entitlements are controlled by this solution. It  also ensures instant policy enforcement to detect and mitigate insider and third-party threats. Hence, the compliance framework is strengthened automatically with the deployment of this solution.

Moreover, security features such as Multi-factor Authentication (MFA), Just-in-Time (JIT) Access, Single Sign-On (SSO), granular level monitoring of every session, User discovery & User mapping (for entitlements), Audit trails and reporting help organizations reinforce the best, adequate and relevant IT security posture for cloud environments. 

Instead of offering excessive and needless privileged rights to create, delete or change configurations of network & storage devices, this solution helps to revoke the entitlements of the super users on time. This way it builds the foundation for a strong Identity and Access Management framework in a multi-cloud environment.

Conclusion

Governing identity is important to protect a multi-cloud environment. The lack of cloud entitlement governance can lead to a devastating data breach and malign the reputation of an organization. 

Implementing cloud-based identity governance like ARCON | Cloud Governance can yield several IT security benefits in the modern IT infrastructure. 

Starting from simplifying the cloud entitlement processes and practices, the solution manages, controls and secures access requests, password reset requests, user provisioning/ de-provisioning and discovery of privileged accounts. 

Overview

Even as the IT community observed the ‘World Password Day’ on May 5, it is surprising and alarming that organizations keep on suffering data breaches due to the misuse of passwords. The idea of ‘World Password Day’ is to remind, reassess and rethink the password management policy in respective organizations. 

On an individual level, we do consider our email passwords or social media account passwords delicate enough to secure our personal information. Who likes to see his/ her privacy breached?

Similarly, on a larger scale, organizations require a robust password management policy to ensure the primary security of confidential databases, cloud resources, critical financial assets, or even overall access management of IT resources. A single credential breach or unauthorized access can wreak havoc on the organization – both financially and reputation-wise.

Here are some incidents of password breaches and consequent catastrophes that happened in the first quarter of 2022. 

These incidents show that somewhere we are still leaving loopholes behind when it comes to managing and protecting passwords for the security of sensitive and confidential business information. 

• A data analytics firm in the USA exposed data of almost 198 million voters due to unprotected passwords – misused by a hackers’ group
• More than 214 million social media users’ details of a European agency were exposed due to easy and password-less access to the database – abused by some insider
• A risk and compliance startup from the APAC region suffered a data breach due to the compromise of passwords by some unauthorized and unknown users

Why are passwords vulnerable? 

To answer this million-dollar question, we must analyze the procedures that IT security teams follow to manage passwords in their organizations. Even if they are privileged passwords, then also organizations throw a lackadaisical attitude towards managing them securely.

More than 80% of data breach incidents happen due to poor privileged password protection strategies (no randomization of passwords, no frequent changes of the passwords etc.). 

A single data breach incident can cost organizations millions of dollars, yet the IT security measures that organizations take to prevent catastrophes are very minimal or sometimes nothing. Still, organizations fail to provide utmost security to all the passwords available in the enterprise network. There are several reasons behind password vulnerabilities:

• Users tend to have simple passwords (eg. names, date of birth, ongoing calendar year etc.) so that they can memorize them easily. However, it increases the vulnerability due to the predictability factor. 
• Users maintain an excel sheet or sometimes a simple word file of all the passwords for convenience. Alternatively, they keep it written somewhere for easy access. None of the processes is secured as it paves the way for the malicious actors to misuse passwords as per their wishes. 
• Passwords shared through emails bear a high risk of misuse. In situations where employees leave the organization and his/ her emails are accessed by someone else, then he/ she could get unwanted access to the passwords. Moreover, if emails are hacked, then also the passwords could lose their confidentiality.
• Another risk, probably the maximum risk lies with shared passwords. A single password shared with multiple end-users can be disastrous as there are chances that the main culprit remains undetected in case of compromise of the account. In worse conditions, it could result in the loss of ownership of the account.

In a vast IT infrastructure, there are thousands of privileged accounts that have privileged credentials to access all the sensitive and confidential business information. Ideally, these credentials should have a robust security mechanism to ensure data security and data privacy. However, organizations often fail to value the crux of passwords and hence, resulting in the vulnerabilities mentioned above. 

Adding to the woes, hacking techniques are getting more sophisticated day by day and the number of passwords is also increasing uncontrollably for various accounts, systems or databases. In this backdrop, the organizations must take adequate IT security measures to ensure secure password management practices.  

 

How do you ensure Password Protection?

ARCON, being a global thought leader in IT risk preventive solutions, always propagates enterprises for implementing the right and adequate password protection techniques. It is one of the most crucial IT security areas for enterprises to protect information assets from malicious and unauthorized access. Moreover, when it comes to privileged passwords, extra preventive measures become mandatory as they are the gateways to all confidential business information. 

The vulnerability of passwords is more evident in a shared and distributed environment. If privileged accounts or credentials are shared by multiple users, information assets are prone to breaches. Hence, organizations must ensure that privileged accounts are resistant enough against password hacks. ARCON’s flagship solution Privileged Access Management (PAM) offers a robust password vault engine that rules out the chances of unauthorized access and password abuse. This powerful automated engine makes sure that –

• The Privileged passwords are stored in a highly secured manner with AES-256 encryption. It creates a centralized secure repository of passwords for multiple systems so that no password can be duplicated by anyone under any circumstance.
• The passwords are automated and frequently rotated and randomized so that the prerequisites of a strong password policy are mandated. It creates a virtual preventive fortress that stops any unauthorized user from accessing any sensitive information at any point of time.
• Privilege password vaulting assists the IT administrators to adopt a robust privileged access management practice that helps in forensic analysis to find out who has done what to the passwords.

Conclusion

Strong passwords are the safety locks that protect the treasure trove of business information from unwanted thefts. ARCON | PAM’s Password Vault tool offers an extra security layer around the credentials in real-time to ensure authorized access to the critical systems and mitigate data breach threats.

An overview

An IT infrastructure of any typical mid-sized or large organization includes hundreds or thousands of end-users who require daily access to systems for conducting several IT administrative and different operational tasks. How do the IT administrators ensure that the right person is accessing the right target system at the right time and for the right purpose? Especially, in a vast privileged access environment, monitoring the existing and new privileged users becomes a real challenge. 

The Just-in-Time (JIT) approach helps the IT administrators to mitigate the misuse of application by cutting down on unnecessary 24*7 access or ‘Always on’ access to the same. The JIT approach is a stepping-stone towards ensuring the risks of data breach are strongly mitigated whilst it helps to practise the principle of least privilege. 

The Context

Almost 75% of global data breach incidents are associated with the compromise of privileged account/s. To understand why the privileged accounts have become easy targets, it is important to know today’s ever-growing IT landscape. 

IT administrators don’t just have to manage and monitor a few privileged identities that access network devices, databases, legacy applications among other types of accounts. The risks stemming from privileged access misuse have multiplied given that SaaS applications have proliferated while there is fast adoption of other cloud services such as DevOps engineering, virtualization and micro-service-based software development. Managing privileged access in third-party environments (Managed Services) has also become a challenge both from security and compliance perspective. 

Due to rapid increase in the number of privileged accounts and administrative accounts in the current IT context, the risk surface has increased significantly. All these services face inherent risks from privileged accounts abuse/misuse. 

And finally, post pandemic, the IT culture has transformed in many ways. Among many changes, the hybrid-work culture is prominent. What that means is that any remote user can access critical applications from any part of the world. Risks increase if there are too many standing privileges. 

The Inherent Risk

Organizations with a vast privileged environment for the sake of convenience end up offering too much unnecessary freedom to the privileged users through standing privileges that results in the risks of misuse of privileged rights. The culprits are majorly malicious actors, compromised insiders or suspicious/ unmonitored third parties who exploit the security vulnerabilities arising from standing privileges that eventually lead to data breaches. Hence, concept of the least privilege principle is jeopardized. 

Adoption of Just-In-Time Privilege Tool – The Benefits

As per organizations’ daily use cases, ARCON | PAM’s Just-In-Time (JIT) Privilege tool lays the foundation of the principle of least privilege. It not just mitigates risks arising from standing privileges but also allows IT administrators to grant privilege rights only on a ‘need-to-know’ and ‘need-to-do’ basis. Moreover, these privileged rights are revoked automatically once the allotted tasks are over. 

Through this process, the administrators can keep continuous track of the privileged rights easily since they grant access to the target system only when it is required. JIT privileges reduce and restrict excessive privileges to servers, databases, business-critical applications and thereby reduce data breach threat surface significantly. 

ARCON | PAM’s JIT Privilege also helps organizations to build the foundation of the Zero Trust Security framework. As the privileges are granted only on-demand for a limited period, they automatically follow the practice of ‘never assume trust’, and the chances of compromising vulnerable IT assets and the privileged accounts reduce by default. 

ARCON | PAM provides access to non-privileged accounts on a time-bound basis in the following ways: 

1. The Privileged Elevation and Delegation Management (PEDM) approach 
2. Use of ephemeral accounts 
3. Use of ephemeral tokens 

The Conclusion

In an uncontrolled IT environment that includes too many standing privileges, it is never possible to ensure ‘trust’ of the end-users and ‘security’ of the IT assets. Once the JIT privilege tool is implemented, the enterprise IT risk control teams can ensure all the end-users as standard users and these users are granted privileged rights only when there is a demand. Moreover, the administrator can ensure secure access control as the JIT approach ensures that the right person is granted access to the right target system at the right time at the right (predefined) time.

Remember the days when our grannies used to keep their secret savings or valuables in the typical iron chests and keep the keys under the mattress to hide the secrets from all? Both family members and outsiders visit grannies’ rooms for different purposes at different hours of the day, so it was necessary for the valuables to have a ‘safe house’ in the form of an iron chest. Our grannies used to be very selective while sharing the ‘secrets’ with others.

Similarly, how do organizations keep their business secrets safe from both ‘internal employees’ and suspicious third-parties? Let us see what could be the best ‘safe house’ for confidential business information.

The Dire Need for My Vault in the ever-evolving enterprise IT Context

In the digital era, the amount of critical data and secrets generated on a daily basis is enormous. Cloud workloads, DevOps engineering, microservices among many kinds of core IT and non-IT (core business functions) demands a robust data protection mechanism. 

In other words, the IT infrastructure teams, business teams, developers, IT engineers et al maintain a large amount of confidential data under the emerging context that needs to be secured from unauthorized access. 

Yet, businesses and organizations from time to time manage their critical data in a manner that could lead to breaches and cyber-attacks. Indeed, over the course of the time, ARCON has analyzed several use-cases where the workforce maintains data and secrets in USBs, shared drives, and shared folders. 

Consider this example: In the last three years, the percentage of global developers who use microservice architecture for production-proven designs has nearly tripled. 

Nevertheless, the transformation comes with a risk. The attack surface increases significantly both from malicious insiders or unintentional exposure if there are no proper access control mechanisms to secure entry points of each and every independent service. 

In DevOPs engineering, there is a theoretical opinion that knowledge-sharing and exchangeable ideas make DevOps an agile development practice. Nevertheless, what it also means is that the DevOps team will have a comprehensive access control over the DevOps’ tool-kit. Uncontrolled and unrestricted access to DevOps tool-chains however means that the principles of role and rule-based access control are not practiced. What if any DevOps tool-chain member takes advantage of the non-segregation of duties and misuses several embedded secrets?

Likewise, there are hundreds or maybe thousands of .xls, .ppt, .pdf, .jpeg or .png files generated every day from different departments. And given rising abuse of critical data and secrets, data security is always at the forefront, be it a SMB or a large organization. 

To ensure security, isn’t it necessary to ensure safe data storage mechanism? Where is the data stored? Is it stored in system hard drives or external hard drives or pen drives in the worst conditions? 

ARCON | My Vault, a safe and secure storage repository 

In a vast and distributed IT environment, managing and storing enterprise data is a real challenge for the IT administrators. ARCON | My Vault solution allows all the end-users to securely store, access and share business information. The files, where this information is stored, remain encrypted and can be deleted easily after a preset time. It also controls the end-users’ activities based on the pre-configured permissions even at a granular level. 

ARCON | My Vault provides end-users the ability to store secrets, certificates, passwords, confidential files, etc. in a highly secured vault. It also provides administrative users managing servers the ability to transfer files from one machine to another without having to go through the interactive access in Privileged Access Management. 

ARCON| My Vault is now offered as a discrete solution (with or without PAM). The solution is based on a microservices framework and is built for the cloud; however, the solution can also be installed on-premise for PAM customers). 

The discrete solution has advanced features like onboarding user groups, tagging businesses, workflow, Just-in-time access to Secrets, Keys, Certificates, Files, etc. Furthermore, one can provide role-based access for sharing, downloading, viewing, or transferring files and secrets. My Vault also provides a simple centralized store for large files (including software, patches, etc.)

Benefits of ARCON | My Vault

• The solution ensures a centralized access framework that helps employees to share and access business-critical files uninterruptedly. To ensure the security of the information a step ahead, these files are accessed exclusively by the My Vault users.
• All the files that are secretly stored in My Vault are accessible only after double authentication of the privileged users. Not just that, every monitoring of the end-users and authentication mechanisms work at a granular level. 
• All the uploaded files are deleted automatically after the pre-designated time period. As a result, the files remain safe from being accessed by irrelevant or unauthorized users.

Conclusion

ARCON| My Vault has emerged as an essential IT need in day-to-day enterprise use cases. Along with data encryption, this enterprise-class tool ensures data integrity and data confidentiality of the organizations. As a result, regulatory compliance requirements are also met round the year.