SYS-CON MEDIA Authors: Jim Kaskade, Yeshim Deniz, Elizabeth White, Sean Houghton, Glenn Rossman

News Feed Item

Three Ways CXOs Can Avert Super-User Security Threats with Privileged Account Management

Today, on Cyber Monday, online retailers and banks are bracing for the likelihood of increased data breaches and security threats, while online shoppers are taking extra precautions to protect personal information. Every day, Americans trust that the corporate and government IT systems handling their critical identity information, such as credit card numbers, social security numbers and tax returns, are equipped with appropriate security measures to keep personal data safe. Heightening awareness of potential security risks is an essential step to thwarting malicious attacks. All too often, however, public and private entities must also recognize that even more risky exposure exists when administrative privilege is exploited, regardless whether by external adversaries or internal threats. Quest Software (now part of Dell) has a deep understanding of the problems organizations face when they don’t properly control and audit administrative access and “super-user” accounts.

According to a survey conducted earlier this year at The Experts Conference, an annual gathering of global IT pros co-sponsored by Quest and Microsoft, half of the responding organizations reported that their No. 1 compliance issue is ensuring correct user access rights (including privileged user access). In the case of managing privileged accounts, this challenge intensifies when administrators are given the “keys to the kingdom,” with far-reaching, shared anonymous access rights to vital IT systems. In the private sector, failure to manage access to information and compliance with security mandates can mean lost revenues, failed audits and damage to the brand. In government, managing user access rights represents a high stakes game in which getting out ahead of emerging threats is a matter of national security. To this point, Privileged Account Management is noted in many security standards, including ISO 27001 and NIST 800-53. A new report developed by Enterprise Management Associates, on behalf of Quest, identifies inadequate administrative access controls as “one of the most egregious IT risk gaps in many organizations.”

The report, “Why You Need to Consider Privileged Access Management (And What You May Not Know About It That You Should),” examines some of the most common excuses companies give to justify this oversight, and offers useful insight into how modern Privileged Account Management (PAM) practices and corresponding technology solutions can close the risk gap with flexible policy control, automated workflows and comprehensive reporting to enhance security, achieve compliance and improve efficiency.

To further help CXOs avert these all-to-common security risks, Quest offers three pragmatic tips:

1. Assign individual accountability to super-user activity

Shared and unmanaged administrative access is more than just a bad idea—it’s one of the fastest and easiest ways to expose an organization to undue risk, especially since these super-user accounts typically have extensive power over IT operating systems, applications, databases, etc. With shared accounts, any security or compliance breach can be traced back only to the account, and not to an individual administrator using that account.

A much better approach to risk containment involves granting administrators access rights only to what they need, as they need it, nothing more or less. Credentials should be issued only on an as-needed basis, accompanied by a full audit trail of who used them, who approved the use, what they did with them, as well as how and why they received them – and the password should be immediately changed once the use is completed. The ability to automate and secure this entire process is an effective way to manage administrative access across an entire organization. Similarly, PAM is essential to enabling federal, state and local agencies to work together, and can make or break government-wide information sharing and collaboration.

2. Implement and enforce a “least privilege” security stance for administrative access

Many administrative accounts, including those for Unix root, Windows or Active Directory admin, DBA, etc., provide unlimited permissions within their scope of control, and, when shared, open the door for malicious activity. For example, the widely publicized security breach at Fannie Mae involved an employee who used this type of super-user access to maliciously plant a logic bomb that, if undiscovered, would have crippled the entire organization and compromised the personal and financial information of approximately 1,100 people.

A more prudent approach is to establish a policy that clearly defines what each administrator (or administrator role) can and cannot do with their access. Since this process can be complicated and often difficult to enforce across diverse systems, Quest recommends the addition of granular delegation tools that are optimized for the designated platforms, and integrated with other PAM technologies such as a privilege safe, multifactor authentication or Active Directory bridge.

3. Reduce privileged account management complexity

One of the overarching PAM challenges comes from navigating diverse IT systems, each with their own unique capabilities and requirements for privileged account management. This often results in the use of specialized tools, along with ad-hoc policies and practices to control privileged account access. Unfortunately, this approach frequently complicates the audit process, making it difficult to prove that all access is controlled and that separation-of-duties principles are established and enforced.

For that reason, consolidating disparate systems into a common identity structure creates an environment where a single PAM approach can be readily enforced with greater consistency across a much larger portion of an organization, eliminating errors borne from multi-system complexity, reducing risk and lowering the expense of managing multiple systems. In addition, any consolidation of PAM capabilities under a common management and reporting interface provides enhanced efficiency.

The EMA report referenced above indicates that organizations focused on achieving a high level of discipline in configuration and change management tend to have better outcomes, not only in lower incidences of disruptive security events, but in better IT reliability, less unplanned IT work, more successful IT changes, higher server-to-system administrator ratios, and more IT projects completed on time and within budget.

Quest® One Identity Solutions Centralize and Simplify Privileged Account Management

Quest Software provides a modular, yet integrated, approach to identity and access management, specifically Privileged Account Management that controls insider threats and improves IT efficiency, as it enables organizations to eliminate the dangers of unchecked super-user access, adverse audit findings, direct penalties, and negative press exposure.

Supporting Quotes:

Jackson Shaw, senior director of product management, Quest Software
“Privileged Account Management will be one of the fastest-growing areas of IAM over the next few years, for good reason. Most of the recent high-profile security breaches, including the UBS Paine Webber attack and the City of San Francisco breach, happened due to lack of control over privileged accounts. What’s more, these breaches do not discriminate; they can cause equally horrific damage to any organization, no matter how large or small. It’s time for companies to take note of the severe security risk posed by poor PAM practices, and seek out a comprehensive solution befitting the task. Quest One offers a complete set of PAM capabilities, providing comprehensive controls in a flexible, modular architecture.”

Scott Crawford, Enterprise Management Associates (EMA)
“Poor controls over administrative access have resulted in real damage. PAM capabilities can help mitigate such risks and improve controls, through techniques such as ‘privilege safe’ technologies that deliver a more disciplined approach to control that supports responsible IT governance. Quest helps IT improve performance and reduce support costs by closing one of the most readily managed gaps of all: the weakness exposed when individuals have broad, anonymous, and unmonitored administrative access to the most sensitive capability in IT.”

Supporting Resources:

About Quest Software (now a part of Dell)

Dell Inc. (NASDAQ: DELL) listens to customers and delivers innovative technology and services that give them the power to do more. Quest, now a part of Dell’s Software Group, provides simple and innovative IT management solutions that enable more than 100,000 global customers to save time and money across physical and virtual environments. Quest products solve complex IT challenges ranging from database management, data protection, identity and access management, monitoring, user workspace management to Windows management. For more information, visit http://www.quest.com or http://www.dell.com.

RSS Feeds:

Technorati Tags:
Quest Software

Dell is a trademark of Dell Inc. Dell disclaims any proprietary interest in the marks and names of others.

Quest, Quest Software, and the Quest logo are trademarks or registered trademarks of Quest Software in the United States and certain other countries. All other names mentioned herein may be trademarks of their respective owners.

More Stories By Business Wire

Copyright © 2009 Business Wire. All rights reserved. Republication or redistribution of Business Wire content is expressly prohibited without the prior written consent of Business Wire. Business Wire shall not be liable for any errors or delays in the content, or for any actions taken in reliance thereon.

Latest Stories
Explosive growth in connected devices. Enormous amounts of data for collection and analysis. Critical use of data for split-second decision making and actionable information. All three are factors in making the Internet of Things a reality. Yet, any one factor would have an IT organization pondering its infrastructure strategy. How should your organization enhance its IT framework to enable an Internet of Things implementation? In his session at Internet of @ThingsExpo, James Kirkland, Chief Ar...
The term culture has had a polarizing effect among DevOps supporters. Some propose that culture change is critical for success with DevOps, but are remiss to define culture. Some talk about a DevOps culture but then reference activities that could lead to culture change and there are those that talk about culture change as a set of behaviors that need to be adopted by those in IT. There is no question that businesses successful in adopting a DevOps mindset have seen departmental culture change, ...
SYS-CON Media announced today that Skytap blog on "DevOps Journal" exceeded 84,000 story reads. DevOps Journal is focused on this critical enterprise IT topic in the world of cloud computing. DevOps Journal brings valuable information to DevOps professionals who are transforming the way enterprise IT is done. Noel Wurst is the managing content editor at Skytap. Skytap provides SaaS-based dev/test environments to the enterprise. Skytap solution removes the inefficiencies and constraints that comp...
The 3rd International Internet of @ThingsExpo, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that its Call for Papers is now open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
The 4th International DevOps Summit, co-located with16th International Cloud Expo – being held June 9-11, 2015, at the Javits Center in New York City, NY – announces that its Call for Papers is now open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the world's large...
SYS-CON Events announced today Isomorphic Software, the global leader in high-end, web-based business applications, will exhibit at SYS-CON's DevOps Summit 2015 New York, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Isomorphic Software is the global leader in high-end, web-based business applications. We develop, market, and support the SmartClient & Smart GWT HTML5/Ajax platform, combining the productivity and performance of traditional desktop software ...
SYS-CON Events announced today that Gridstore™, the leader in hyper-converged infrastructure purpose-built to optimize Microsoft workloads, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Gridstore™ is the leader in hyper-converged infrastructure purpose-built for Microsoft workloads and designed to accelerate applications in virtualized environments. Gridstore’s hyper-converged infrastructure is the ...
The security devil is always in the details of the attack: the ones you've endured, the ones you prepare yourself to fend off, and the ones that, you fear, will catch you completely unaware and defenseless. The Internet of Things (IoT) is nothing if not an endless proliferation of details. It's the vision of a world in which continuous Internet connectivity and addressability is embedded into a growing range of human artifacts, into the natural world, and even into our smartphones, appliances, a...
Fundamentally, SDN is still mostly about network plumbing. While plumbing may be useful to tinker with, what you can do with your plumbing is far more intriguing. A rigid interpretation of SDN confines it to Layers 2 and 3, and that's reasonable. But SDN opens opportunities for novel constructions in Layers 4 to 7 that solve real operational problems in data centers. "Data center," in fact, might become anachronistic - data is everywhere, constantly on the move, seemingly always overflowing. Net...
"ElasticBox is an enterprise company that makes it very easy for developers and IT ops to collaborate to develop, build and deploy applications on any cloud - private, public or hybrid," stated Monish Sharma, VP of Customer Success at ElasticBox, in this SYS-CON.tv interview at DevOps Summit, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
"Matrix is an ambitious open standard and implementation that's set up to break down the fragmentation problems that exist in IP messaging and VoIP communication," explained John Woolf, Technical Evangelist at Matrix, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
How do APIs and IoT relate? The answer is not as simple as merely adding an API on top of a dumb device, but rather about understanding the architectural patterns for implementing an IoT fabric. There are typically two or three trends: Exposing the device to a management framework Exposing that management framework to a business centric logic Exposing that business layer and data to end users. This last trend is the IoT stack, which involves a new shift in the separation of what stuff happe...
The Internet of Things will put IT to its ultimate test by creating infinite new opportunities to digitize products and services, generate and analyze new data to improve customer satisfaction, and discover new ways to gain a competitive advantage across nearly every industry. In order to help corporate business units to capitalize on the rapidly evolving IoT opportunities, IT must stand up to a new set of challenges. In his session at @ThingsExpo, Jeff Kaplan, Managing Director of THINKstrateg...
The Internet of Things promises to transform businesses (and lives), but navigating the business and technical path to success can be difficult to understand. In his session at @ThingsExpo, Sean Lorenz, Technical Product Manager for Xively at LogMeIn, demonstrated how to approach creating broadly successful connected customer solutions using real world business transformation studies including New England BioLabs and more.
An entirely new security model is needed for the Internet of Things, or is it? Can we save some old and tested controls for this new and different environment? In his session at @ThingsExpo, New York's at the Javits Center, Davi Ottenheimer, EMC Senior Director of Trust, reviewed hands-on lessons with IoT devices and reveal a new risk balance you might not expect. Davi Ottenheimer, EMC Senior Director of Trust, has more than nineteen years' experience managing global security operations and asse...