Basic Privileged Account Management
Abused and Misused privileges are often seen as being the cause of breaches within organizations around the world. Privileged account management should be a major focus for Security and IT management who are looking to mitigate the risks of data breaches and insider risks.
What is Privileged Account Management?
Privilege Account Management is the definition and management of policies and processes that define the ways in which the user is provided access rights to enterprise systems. It governs the management of the data that constitutes the user’s privileges and other attributes, including the storage, organization and access to information in directories (FICAM-09). In other words, how an organization manages privileged passwords and delegates privileged actions. Do you delegate, control, and filter privileged operations that an administrator can execute? Do you audit, record, and monitor privileged access?
Why is it important to an organization?
When it comes to utilizing high business value IT systems, privileged users, such as administrators, typically have the widest operational latitude. They are typically responsible for deploying and managing functionality on which the business depends, from vital day-to-day functions, to strategic capabilities that enable the business to maintain its competitive edge.
However, there are risks to wielding this power. IT complexity means that minor changes could potentially have unintended, and severe impacts on availability, performance, and/or integrity. Malicious attackers, inside and outside of the organization, can capitalize on administrative level access to inflict serious damage to the business. Given the increasing sophistication and popularity of modern attacks via malware and other methods, it is common for attackers to gain and exploit such privileges by impersonating trustworthy personnel.
What are some common best practices?
There are countless solutions out there for organizations to implement and everyone has their opinion on what is the best way to do it. Below are a set of common privileged account best practices all organizations should follow:
- Separate regular access accounts from privileged accounts
- Inventory all privileged accounts and assign ownership to that inventory
- Do not use shared accounts
- Minimize the number of personal privileged accounts
- Limit scope for each privileged account
- Use privilege elevation for users with regular access
- Document policies and processes for the management of privileged accounts
- Monitor and log all privileged access activity
- Implement separation of duties model to manage superuser administrative privileges
- Use default administrator, root, and similar accounts only when absolutely necessary
- Require multi-factor authentication for all privileged accounts
- Require complex and long passwords for privileged accounts
- For service or application privileged accounts store passwords in an encrypted vault with a random password
