What are the four key privileged account access capabilities for enterprises? Which tools can help protect your most powerful users from malicious compromise?
According to privileged access management provider Centrify, 74 percent of enterprises suffered a data breach due to stolen privileged accounts. In fact, Forrester Research estimated that an even higher 80 percent of breaches involve privileged access management.
However, only 26 percent of United States enterprises expressed confusion over the concept of privileged access management. Therefore, you need to understand the privileged account access capabilities necessary to modern cybersecurity.
Here they are!
The Four Key Privileged Account Access Capabilities
1. The Principle of Least Privileges
The Principle of Least Privileges states users should only possess the privileges they need to perform their job duties. Indeed, the idea of special privileges or legacy permissions is anathema to the Principle of Least Privilege. Instead, you need to cut or curtail permissions as much as possible.
The more privileges your users possess, the more danger each privileged account poses overall. For example, imagine if your HR head could access your financial records. Practically, this user does not need these records—thus these permissions only constitute a vulnerability. Hackers could easily commandeer the credentials and therefore access the financial records. Alternatively, your users could turn malicious or negligence and damage your workflows directly.
Thankfully, privileged account access capabilities can help. Privileged account access can help you integrate with Identity Governance to gain visibility on your users’ permissions and remove whatever proves unnecessary. Additionally, the Principle of Least Privileges helps ensure limited temporary permissions. So many privileged accounts become bloated due to temporary permissions never being revoked after the project’s end.
2. Multifactor Authentication (MFA)
Previously, we wrote on passwords; more specifically, how passwords possess several weaknesses. Notably, these include being easy to guess, being easy to crack, being easy to phish, and being constantly repeated across multiple accounts. In fact, the latter contributes to a cascading effect, as repeated passwords allow hackers into multiple servers, databases, and networks.
Therefore, building more authentication around passwords must become a key consideration for your privileged account access capabilities. While enterprises may never truly rid themselves of passwords, they can supplement and strengthen them. Each authentication factor between the user and the database represents another hurdle to hackers. Hence the power of multifactor authentication among privileged account access capabilities.
Of course, hackers can subvert or bypass any number of authentication factors over time. However, most hackers would prefer to target weaker enterprises for a faster profit. In other words, multifactor authentication can passively deter as many hackers as it actively deflects.
Multifactor authentication can include passwords as well as hard tokens, geofencing, time of access monitoring, biometrics, and behavioral analysis. The last of these proves especially important; it allows your cybersecurity to conduct continuous authentication even after the initial log-in.
Don’t let privileged account access capabilities end at the door. Make it a consistent part of your business processes.
3. Privileged Session Management
Among privileged account access capabilities, session management offers your IT security team the ability to monitor and record privileged sessions. Thus, you give your team a better window for auditing and helps exhibit control over your users’ privileged identities.
Sophisticated, next-generation privileged session management should enable you to observe the date, time, and location of each session. In fact, you should have visibility over users’ exact keystrokes to ensure the authenticity of each privileged user. This can prevent insider threats and hackers alike by making sure users use their permissions according to business standards.
4. Privileged Account Discovery
One of the most common privileged access management mistakes involves visibility; as always, visibility can make or break your enterprise’s cybersecurity. Generally, you can’t protect what you can’t see. This includes privileged accounts—visibility impacts the effectiveness of your privileged account access capabilities.
However, so many enterprises fail to even look for all of the privileged accounts connecting to their networks. Indeed, Thycotic found that nearly three-fourths of all enterprises fail to discover all of their privileged access accounts. Also, 40 percent never attempt to look for all of their network’s privileged accounts.
Often, the problem facing enterprises, in this case, involves legacy privileged access management solutions. Sticking with a PAM solution that can’t offer you next-generation capabilities, such as improved visibility, leaves you vulnerable. Additionally, legacy solutions rarely possess the threat intelligence necessary for proper identity and access management.
Thankfully, modern capabilities help improve visibility and prevent accounts from becoming hidden or blindspots. It facilitates onboarding, offboarding, and with users’ lateral role movements within enterprises.
How to Learn More About Privileged Account Access Capabilities
Be sure to check out our 2019 Privileged Buyer’s Guide for more information. We cover the top vendors in the field and their key capabilities. You can also check out our Identity Buyer’s Guide and our Identity Vendor Map.
Latest posts by Ben Canner (see all)
- Key Findings: The Gartner 2019 Critical Capabilities for Identity Governance and Administration - November 13, 2019
- 60 Percent of Enterprises Misunderstand Cloud Security Responsibility Sharing - November 12, 2019
- 5 Identity Management Insight Videos for 2019 (and 2020) - November 11, 2019