* Umberto Rosti
Privileged account access and management credentials: what you need to know.
Days ago, at an information security conference, some recent cases of information leakage were analyzed and it was very clear that one of the biggest challenges of CISOs and most companies is still the Identity and Access Management more specifically cprivileges for access and management of privileged accounts.
According to Forrester, 80% of data leakage incidents were primarily misused or abused privileged credentials.
But what is a privileged user?
a privileged user is someone with administrative access to critical systems such as organization-wide email accounts, CRM and ERP systems, and more. Every employee needs a certain level of access to corporate information based on their role, department, etc. - but privileged access goes beyond that!
But when you think about Identity and Access Management (IAM) do you think about Privileged Account Management (PAM)? The answer is no and that can be a mistake!
In fact, I understand that PAM should come before IAM or SoD (Segregation of Duties), solutions so requested by the External Audit.
Privileged Access Management has become a priority, according to Gartner study annex, this is the second year in a row that PAM appears as the number one priority for investments in security technologies.
Why? Because we know that in every organization, there are always one or more people with access to CEO login credentials for both email and critical systems.
Do you know who these people are in your organization? Were they properly examined? When was the last time they changed roles and their access changed? What happens when they go on vacation? Do your system administrators (IT) have privileged access to systems, do they have control over access and reasons? Did they read the organization's emails, access any sensitive files?
Do you know who is usually targeted at your hackers and phishings to get the credentials? Secretaries? IT administrators?
Worrying, right?
Let's say we have access to a certain user, which means that the right people can access the right information at the right time, and more importantly, in my opinion, for the right reasons. How do you ensure continued control of this access and protect these privileged users from hackers who can direct them?
After all, privileged credentials are the best spying resource. According to the BeyondTrust, these credentials allow attackers to access your organization's most critical data by posing as a trusted member.
Indeed #8220; Privileged users have control of every technology environment & #8221 ;, says Fabricio Simão, director of BeyondTrust. The inexistence of a PAM solution It can expose organizations in unimaginable ways and lead to disastrous results.
We are also seeing more and more organizations turning to their MSSPs for support for identity-managed services. This type of service helps many companies achieve policy and regulatory compliance and offers many benefits above and beyond a standard SIEM managed service, including:
- 24/7 IAM platform health monitoring without increasing your security staff
- Get visibility and control of user data and access permissions
- Quickly detect risk and change access issues associated with privileged users
- Automate the user provisioning process based on groups and policies.
- Accelerate Unified Top-Down Governance Process Compliance Efforts for All Users
Making an analogy, which is more important: automating the process of handing over the crown jewelry keys, or protecting the crown keys by restricting access to them?
The important thing is to reflect that before investing in expensive and complex cyber security systems, the most efficient would be invest on the right privileged access control tools, building a process and utilizing third-party support to automate provisioning and controls wherever possible.
* Umberto Rosti is CEO of Safeway
Regarding the [SAFEWAY]
SAFEWAY is an Information Security company, recognized by its customers for offering high value added solutions through Information Security projects that fully meet business needs. During these years of experience, we have proudly accumulated several successful projects that have earned us credibility and prominence in our clients, which constitute in large part the 100 largest companies in Brazil.
Today through more than 17 strategic partnerships with global manufacturers and our SOC, SAFEWAY is considered a one stop shopping with the best technology solutions, processes and people.
Let's make the world a safer place to live and do business!
