Month: June 2022

The Context

A robust privileged session reporting engine is at the cornerstone of secure privileged access management frameworks. Organizations require reporting tools to ensure regulatory compliance, audit readiness, and regular IT security assessments in a privileged access environment.

The demand for frequent and random analysis of privileged sessions is increasing day by day due to the rapid expansion of privileged access environments. A reporting tool fulfills the requirement of comprehensive vigilance of hundreds of privileged users and their activities in a vast critical privileged access environment.

However, in the recent past, IT security experts have expected the reporting mechanism to go beyond just the identification and detection of end-user anomalies. 

The analytical user data received from the reports is expected to be more fine-grained in nature and should allow the IT risk management team to do risk predictive analysis. While doing the IT security assessments from the automated reports, the data needs to give an analytical overview of the user’s behaviour, his or her tendencies, and the risks involved (if any). In addition, IT risk management teams expect deeper analysis from the logged data to understand the work/privileged session patterns.

To address these contextual use-cases in an enterprise setup, ARCON emphasizes the importance of deploying three advanced analytics tools. These tools, once leveraged with privileged access management, will significantly improve the privileged access threat landscape.                 

Let’s drill down deeper

While generating reports of the privileged sessions, whether automated or customized,  organizations emphasize maximum on the IT threat predictive parameters. ARCON Knight Analytics is a highly effective tool. 

I] Knight Analytics

This is an AI-based behaviour analytics tool that uses deep-learning threat detection techniques to assess the level of IT risks. Based on the historic data of the users, the IT risk management team can detect and predict anomalies in the logged data. It assesses the threat percentage from six different graphs and displays the anomalies of the logged data by using machine learning algorithms.

• User analytics
• Service Analytics
• User Group Analytics
• Service Group Analytics
• Group-wise User Analytics
• Group-wise Service Analytics

II] Spection

The regular process of generating reports encompasses a wide range of subjective requirements. Quite often, this becomes a challenging task to accommodate all the requirements in a single report, or rather in a single pattern/ type of report. For instance, the requirement of a graphical report is not possible to fulfill with a pie-chart or bar-chart pattern statistical report.

To address the challenge, Spection offers the flexibility to choose a report and view it as per individual requirement pattern. The admins can select required user entities, the features of working model, and elements of the user tasks, etc. and then filter it date-wise to generate a dynamic and customized report. To offer the flexibility of the report patterns a step ahead, spection helps to display it in both statistical and graphical ways. 

III] Smart Session Monitoring (SSM)

This advanced session monitoring module helps IT risk management teams with fast-track reviews of the user activities. It seamlessly monitors activities performed on the server specially Windows RDP and connector servers. SSM continuously keeps a track on the user activities, mouse-clicks, optical character recognition, and the keystrokes. The IT admins can search for these activity logs with specific keywords and thereby navigate through the exact requirements.

Just to add to the above, ARCON also helps to build the foundation of zero trust network architecture that allows every user to access whatever they want to but their every log is monitored and assessed. The advanced reporting tools, in fact, help the organizations to assess the level of trustworthiness they should nurture for every individual user. And if it’s a privileged access environment, then it is highly imperative to reinforce these reporting tools.

Conclusion

Safeguarding privileged access environments is no more restricted to just meeting stringent compliance policies and staying audit ready. Today, organizations demand advanced reporting tools that can produce detailed analytical reports of the privileged tasks and predict IT threats seamlessly based on the user data. 

The Context

In a vast and distributed IT infrastructure, IT administrators always face a huge risk of numerous unknown privileged accounts that are shared among multiple users. It’s an enormous challenge for the IT security and IT risk management team to identify the ownership of the privileged accounts if created in a group or on an ad-hoc basis. Not just user accounts, software, and service accounts, if not tracked with the owners, might face multiple risks of anomalous activities – especially with the lifecycle of that privileged account.  

Many organizations follow strict user onboarding policies for any device, server, router, etc. separately so that the onboarding process across multiple systems is done systematically. However, at the end of the tasks, if the offboarding process is not taken care of, then it leads to the piling up of a lot of invalid IPs that accumulate across the system. Eventually, the IT administrator loses the track of ‘who’ is the owner of the account and ‘what’ is the purpose of the account. 

As a result, organizations might face disastrous consequences if the unidentified user accounts grow rampantly across the IT infrastructure. 

In this blog, we have discussed how organizations can identify and remove all the unidentified and suspicious privileged accounts and safeguard their critical systems from unknown activities. 

How to remove unmanaged privileged accounts?

A robust access management system with an automated tool that could filter and separate the unidentified identities is the best and only solution for this. The best-in-class ARCON | Privileged Access Management (PAM) solution offers an Auto-Discovery tool that thoroughly scans the enterprise network (also individual IPs) and segregates the active privileged accounts from the inactive ones. This way, it allows the IT administrators to detect the unmanaged or unidentified privileged accounts spread across the IT environment and remove them before anything malicious happens. ARCON | Auto-Discovery module consists of two entities:

1) Asset Discovery

2) Privilege User Discovery

Let us elucidate further how organizations reap the benefits from these.

Asset Discovery: This helps organizations to find out different IT assets such as databases, network devices, printers, windows servers, desktops, etc. in an IT environment. It also identifies if these assets are lying in a privileged access environment and are accessed only by authorized and authenticated privileged users. Otherwise, the unidentified ones are detected and flagged off to the IT administrator so that necessary actions are taken. 

The asset discovery module also helps organizations in scanning various ports on a user machine and identifies all the necessary and unnecessary ports of the system. 

Privileged User Discovery: Unmanaged and unidentified shared privileged accounts always bear unpredictable IT risks in a distributed IT infrastructure. However, it is a real challenge for the IT administrators to find out the legitimacy of every account including the owners’ identities. 

Further, if the IT infrastructure is distributed and there are hundreds of users including SSH users, active directory users, Windows users, Linux users, Unix users, and macOS users in the network, then the task becomes almost impossible. It allows the IT administrator to figure out all the legitimate privileged accounts on the system and determine whether they are on-boarded as well.

The entire process of Privilege User Discovery is also designed in a manner so that it can be part of overall identity governance in an enterprise because, without it, there cannot be any track of role and rule-based users in the network. Moreover, it helps in standard regulatory compliance that demands strong governance of privileged identities in an organization.

• Identification of the Unknown Accounts
• Detection & segregation of unmanaged privileged accounts
• Co-relate the accounts with the on-boarded identities
• Automatically finds users on any targeted server (Windows, Linux, etc.)

Conclusion

Lifecycle management of identity is extremely critical to ensure a robust identity and access management fabric. Auto-discovery enables IT teams to better manage the lifecycle of privileged accounts.

The Context

Data breach incidents in 2022 have reached an all-time high with 43% of total data breach incidents happening due to malicious insiders, as per World Economic Forum.

But why? Here’s an explanation.

In the age of digitalization, every organization requires a set of users who are authorized to perform a specific set of sensitive tasks that involve confidential data assets. These users have privileged entitlements, sometimes they are privileged users. As organizations grow, both in terms of workforce and expansion of IT infrastructure, the number of privileged users increases simultaneously. 

In the last few years, there is increased adoption of cloud computing, virtualization, SaaS-based applications, and DevOps practices, among other IT practices. 

While organizations adopt such new computing, storage, and development methods, they tend to create more privileged users and privileged accounts. So the responsibilities to manage, monitor, and control the privileged tasks also increases. 

Secure access management practices for critical systems ensure uninterrupted IT operations. With numerous privileged access control use cases emerging everywhere, the attack surface also expands. Cyber criminals and malicious insiders always target these privileged accounts to get unauthorized access to confidential business information and secrets. 

Typically, the attack vector grows when end-users are granted standing privileged elevation, in other words, the absence of privileged elevation on-demand is one of the biggest causes of data breaches. If the ‘Least Privilege’ principle is not followed, it automatically makes organizations vulnerable to a data breach.

Let us discuss five reasons why organizations need privileged elevation on-demand on an urgent basis.

Why is Privilege Elevation on-demand important?

1. To enforce granular control over temporary privileged users: Sometimes, non-privileged users working on Windows, Linux, Unix servers or MacOS are given temporary privileged rights to perform certain privileged tasks. However, quite often, these privileged rights are not revoked even after the completion of the task. As a result, these unnecessary standing privileges invite chances of misuse of privileged rights and subsequent IT misadventures. 

ARCON | Privileged Access Management (PAM)’s Privileged Elevation and Delegation Management (PEDM) tool offers a granular level approach to each and every user in the IT environment by granting temporary privileged access rights only on ‘need-to-know’ and ‘need-to-do’ basis. Not only that, it automates the process of temporary privileged access and the rights are revoked immediately after the completion of the tasks. 

2. To ensure control over privileged accounts created on an ad-hoc basis: During increased adoption of SaaS applications, organizations tend to create ad-hoc privileged users to perform highly elevated tasks on a number of business-critical applications. With no rules and role-based mechanisms, organizations automatically endanger their critical applications from malicious users.

3. Too Much Liberty (24X7 access) and the need to remove excessive standing privileges: Different users require privileged access to different applications for different purposes at different hours of the day. There are hardly any end-users who might require 24X7 access to the critical systems or applications. To ensure data privacy and data security, organizations must opt for privileged elevation on-demand so that the privileged user can access the required applications only when there is any genuine requirement. Otherwise, too much liberty of anytime access could be counterproductive. 

ARCON | Just-In-Time (JIT) Privilege does the job of such restricted access. Once deployed, the privileged user would be automatically prevented from accessing the systems outside the designated hour and domain. It secures the enterprise database from thefts and unauthorized access.

4. To ensure access control in a hybrid work environment: We live in a hybrid work environment, where the end-users access critical systems both on-prem and remotely. In this scenario, how is it possible for organizations to ensure that the right user is accessing the right application at the right time for the right purpose? To ensure a secure and requirement-based critical access control mechanism, organizations must adopt privileged elevation on-demand. It eliminates the chances of unauthorized access to critical systems.

5. Compliance: Many global regulatory standards such as GDPR, FedRAMP, NIST, SOC 2, PCI-DSS, HIPAA, NESA, and regional IT security standards demand a set of IT security controls for every organization, which includes the ‘Least Privilege’ principle, a mandatory requirement. If organizations follow the ‘Least Privilege’ principle, then they can avoid the risks of excessive standing privileges. It can be securely done through privilege elevation on-demand. ARCON’s Just-In-Time (JIT) Privilege solution and Privilege Elevation and Delegation Management (PEDM) tool help organizations follow the ‘Least Privilege’ principle and stay compliant with the regulatory standards.

Conclusion

The practice of on-demand Privilege Elevation addresses the challenges of whom to allow access for which application, for what purpose and when. Serious security concerns, specially over-privileged users or excessive standing privileges, are always there to play a spoilsport. Adequate preventive measures such as Just-In-Time (JIT) privilege and Privilege Elevation and Delegation Management (PEDM) tools ensure that your privileged access environment is safe and secure. 

Overview

Post-pandemic, businesses are looking for IT agility and increased mobility with many organizations opting for a cloud-first approach. Indeed, what we are witnessing now is the increased pace of cloud adoption. More and more organizations are adopting multiple public clouds, agile development platforms, and containerization technologies to boost overall IT efficiency. 

Nevertheless, whatever be the industry or organization size, one concern  (or maybe priority) remains the same ie. cloud access governance and data security. To keep up with the expanding cloud infrastructure, today’s organizations require unambiguous and fundamental governance programs to mitigate the various threats and vulnerabilities arising from the adoption of disparate cloud technologies. 

Compliance with guidelines mandated by various regulatory authorities and IT standards plays a big role to ensure data security, implement adequate IT security policy and above all – maintain the digital trust and reliability among customers. 

So what could be done to ensure Cloud Compliance? What importance do organizations give to cloud compliance in a modern IT infrastructure?

Cloud-first approach and governance challenges: Where is the loophole?

Typically, organizations opt for cloud platforms long before they are ready for it and are aware of the compliance standards. This complicates the situation. Once an organization migrates the workloads and data on cloud, it should first align its security framework with the best practices on cloud.

It should ask whether the cloud service provider (CSP) can enable them to implement the guidelines. If yes, at what level? In general, CSPs will provide a basic security framework to protect data, but ensuring a foolproof security posture is a shared responsibility between the CSP and the organization which migrates the workloads to the cloud. It is extremely critical for an organization to alter its policies as per compliance requirements. The round table should start before the cloud service is deployed and not after that.

Cloud compliance is one of the leading challenges faced by organizations that aim to migrate existing workloads to the cloud. Our market research suggests that more than 50% of organizations face the compliance and audit challenges associated with IaaS infrastructure. Among them, 32% of organizations find that the access control mechanisms and user authorization policies are inadequate to secure cloud access and ensure governance. So what could be done? 

Adhering to compliance frameworks helps to build the foundation for a robust cloud governance framework. For instance, in the US there are several cloud governance guidelines and certifications that help organizations to build a reliable security posture. In this blog we have covered some of those guidelines. Information security professionals can align their security controls by developing a framework from those certifications and guidelines, regardless of geographical location. 

• FedRAMP or the “Federal Risk and Authorization Management Program” compliance standardizes security assessment and authorization for cloud products and services used by U.S. federal agencies. The basic and standard objective of this compliance is to make sure that the federal data is consistently monitored and protected with a high level of security on-cloud.

 

• The objective of NIST or National Institute of Standards and Technology compliance is to comply with the requirements of one or more NIST standards. The primary role of this non-regulatory agency under the US Department of Commerce is to develop security standards (mainly security controls) for various industries.

 

• Developed by the American Institute of CPAs (AICPA), SOC 2 compliance is a standard for service organizations that specifies how organizations should manage customer data. This compliance standard is based on the Criteria: security, availability, processing integrity, confidentiality, and privacy.

Here are some of the requirements mandated by these standards:

FedRAMP: 

• Access Control Policy and Procedures 
• Least Privilege 
• Authorized  Access to Security functions 
• Least Privilege – Non privileged access for non-security functions
• Least Privilege – Network Access to Privileged commands
• Least Privilege – Prohibit non-privileged users from executing privileged functions
• Remote Access – Automated Monitoring
• Remote Access – Privileged Access
• Audit and Accountability
• Audit Review Analysis and Reporting
• Continuous Monitoring
• Identification and Authentication Policy and Procedure
• Identification and Authentication (Organizational Users)
• Identification and Authentication (Network Access to Privileged Accounts)
• Authenticator Management (Password-based Authentication)
• Security Awareness | Insider Threat

NIST: 

• Cloud Service Provider (CSP) Provisioning
• Cloud Auditor
• Cloud Computing (secured on-demand network access and rapid user provisioning)
• Multi-cloud (governance) 

SOC2

• Control Third-party in Cloud environment

Essentially what these guidelines require from organizations and CSPs are to have an ability to allocate resources based on predefined policies and procedures along with monitoring and auditing of those resources, especially around privileged accounts. These guidelines help to establish parameters that in turn enable organizations to meet the best practices in cloud governance whilst managing the compliance requirements. 

At ARCON, we have been developing cloud-native applications as we want to ensure organizations’ cloud-first journey is a success. A host of solutions such as ARCON | Privileged Access Management, My Vault, Identity and Access Management solutions help to reinforce the governance framework around the cloud infrastructure. 

Whether edge devices, mission-critical applications, network devices or secrets in CI/CD pipelines – our solutions provide adequate layers of security to mitigate data breach vulnerabilities. User provisioning (de-provisioning), the discovery of all privileged accounts, JIT Privileges for implementing the least privilege approach, Vaults to manage and securely store passwords, certificates, keys, tokens and secrets along with strong monitoring and reporting engine ensures that all the guidelines being mandated by various standards are complied with. 

Conclusion

The acceptance and proliferation of cloud technologies is necessitating the adherence to compliance mandates. When implemented effectively by CSP and cloud users, a robust cloud governance framework can be built to mitigate data breach vulnerabilities.