There are three core areas of focus when managing and controlling access: Authentication, Authorization and Accountability. We call it 3As.
- Authentication is focused on verifying the identity of an individual and proving that someone is who they claim to be.
- Authorization is controlling and managing what access an individual has.
- Accountability is tracking and monitoring what a user account is doing, looking for and finding indications of a compromise.
The key component of authorization is least privilege: giving someone the least amount of access they need to do their job, and properly maintaining that access. The two big problems with least privilege are minimal access and expiration of access.
When assigning or providing access, in many cases an admin is not sure whether or not someone needs access. In the past, if an admin was not sure if a user needed access, the default rule was to go ahead and provide the user with access. While this potentially minimized support desk calls and user frustration, it introduced considerable risk.
If you provide additional access and it is not needed, no one ever notifies the help desk. Ultimately, providing access to a user beyond what he or she needs to perform his/her role leads to a massively increased attack surface that leaves organizations wide open to damage from hackers and insiders.
However, if we have a paradigm shift and not provide access unless we are 100% sure of a user’s need, the system will stay in a secure state.
Now, if the access is not provided and it is needed, the user can notify the help desk, get appropriate approval, and then get the access added. In light of many disastrous real world examples of privileged access gone wild, this is a much safer and smarter approach to managing access. If it is intelligently implemented, the initial user frustration and help desk calls can be mitigated with granular policies, versus broad strokes of privileged denials.
Expiration of Access
The second big problem with data access is expiration. In most organizations, once access is provided to a piece of information, it is never removed. This leads to what I call the sticky principle. Over the course of employment at an organization, as a user’s role and responsibilities change (or the technologies they need to access grow), more access is granted to the user. However, rarely is the previous access, when no longer relevant to a user’s role, removed.
I have seen this in many organizations where someone who has worked for the company for 20 years in various different roles and, thus, has accumulated access to almost every piece of information and system.
Thus, a best practice is to set expiration dates for access. Therefore, after a certain period of time, if the access is not renewed or extended, it will expire and proper access will be maintained on the system. This is analogous to the expiration of your password and requires a simple periodic reset.
How BeyondTrust Can Help
Eliminating excessive rights on user endpoints is a common starting point for many organizations to close avoidable security gaps, but legacy approaches to solving this problem are insufficient. Existing tools lack visibility into the security profile of applications targeted for elevation, and the risk-reducing effects of eliminating over-privileged users are negated if a vulnerable or exploited application is elevated for use. The traditional approach to solving these endpoint least privilege problems requires security and IT teams to cobble together point tools from multiple vendors resulting in unnecessary complexity and cost, and no visibility into user behavior throughout the enterprise.
BeyondTrust solves this problem by:
- Removing excessive rights on all endpoints, reducing risk, and simplifying least privilege enforcement
- Providing visibility into target system and asset security, reducing risk from elevated application vulnerabilities
- Providing application control on the endpoint, block listing hacking tools
- Analyzing and reporting on privileged user and account behavior, reducing risk from anomalies
- Delivering a modular, integrated platform, speeding implementations and reducing costs
If you would like to learn more about how you can take these best practice recommendations and translate them into real use cases, download my white paper, It’s All About the Endpoint: Protecting and Enabling End Users with Least Privilege.
Dr. Eric Cole, Cyber Security Scientist | Keynote Speaker | Author | Founder and CEO at Secure Anchor Consulting
Dr. Cole is an industry-recognized security expert with over 20 years of hands-on experience. Dr. Cole has experience in information technology with a focus on helping customers focus on the right areas of security by building out a dynamic defense. Dr. Cole has a master's degree in computer science from NYIT and a doctorate from Pace University with a concentration in information security. He served as CTO of McAfee and Chief Scientist for Lockheed Martin.
Dr. Cole is the author of several books, including Advanced Persistent Threat, Hackers Beware, Hiding in Plain Sight, Network Security Bible 2nd Edition, and Insider Threat. He is the inventor of over 20 patents and is a researcher, writer, and speaker. He is also a member of the Commission on Cyber Security for the 44th President and several executive advisory boards. Dr. Cole is the founder and an executive leader at Secure Anchor Consulting where he provides leading-edge cyber security consulting services, expert witness work, and leads research and development initiatives to advance the state-of-the-art in information systems security. Dr. Cole was the lone inductee into the InfoSec European Hall of Fame in 2014.
Dr. Cole is a Former SANS Faculty Fellow who was actively involved with the SANS Technology Institute (STI), including the students, teachers, and courseware.