Free Privileged Account Discovery Tool: Identify & secure credentials to stop lateral movement. Download Free

BeyondTrust
  • Products
    Privileged Password Management
    Discover, manage, audit, and monitor privileged accounts
    Password Safe DevOps Secrets Safe
    Endpoint Privilege Management
    Manage privileges on Windows, Mac, Linux, and Unix endpoints
    Windows and Mac Unix and Linux Active Directory Bridge
    Secure Remote Access
    Centrally manage and secure remote access for service desks and vendors
    Remote Support Privileged Remote Access
    BeyondInsight Analytics
    See All Solutions
  • Resources

    Universal Privilege Management

    Our innovative Universal Privilege Management approach secures every user, asset, and session across your entire enterprise.

    Watch Video

    Learn

    Case Studies
    Competitor Comparisons
    Datasheets
    Glossary
    Product Demos
    Whitepapers

    Attend

    Events
    Go Beyond
    Training
    Webinars

    Support

    Changelog
    Professional Services
    Technical Documentation
  • Blog
  • Partners
  • Contact
  • Support
  • Services
  • Training
  • Events
  • Company

Three Overlooked Privileged Access Risks

May 18, 2020

  • Blog
  • Archive

Most practitioners of Privileged Access Management (PAM) tend to focus on reducing, managing, securing, and auditing the administrator and root accounts that have god-like access to their environment and assets. Some typical focuses include:

  • Managing privileged credentials (rotating passwords, certification based on access, etc.)
  • Removing administrative rights from all endpoints
  • Enforcing least privilege across all users, applications, and processes across Windows, macOS, Unix & Linux, and even network devices
  • Providing secure local and remote session monitoring capabilities (keystroke logging, etc.)
  • Reporting and auditing for privileged activity anytime privileges are invoked

However, there are plenty of other privileged activities that have abstract access within your environment that can cause a world of pain if not properly managed. Many of them are not even identity or account-based. If not properly managed for privileged access, they can actually represent a “game over” event for any organization or individual.

Don’t overlook these three privileged access risks:

  1. “All” email groups – Almost all environments have an “all” email group that allows executives or human resources to mass email all employees within an organization. This is typically used for emailing information that is relevant to all employee, such as next year’s holiday schedule, benefit enrollment information, or even unfortunate events that may affect a large group of people or the entire company.
  2. Human Interface Devices (HID) – While many of the readers may consider a printer as an old school piece of technology that does not have modern attack vectors, this is far from the truth. Most modern printers and HIDs are “smart”. They can have access via the web, have browser interfaces, and can support multiple protocols for functions like printing and monitoring, including legacy ones like SNMP and FTP.
  3. Vendors – Ask yourself a simple question: What privileged access do your vendors have into your environment, and what privileged access do you have into your suppliers’ environments? Actually, that was a trick question and not a simple one to answer.

If this “all” group is accessible externally or internally by a threat actor or disgruntled employee, the results can be devasting – for everyone. Think this is far-fetched? Some months back, I had discussions with a CEO whose company did not properly secure the “all” email group and a threat actor sent child pornography to the entire company. Legally, the company did the right thing. They contacted the FBI and scrubbed every mail server, computer, laptop, and mobile phone to remove the images. This one nefarious email sent by a disgusting individual shut the business down for an extended period of time. The lesson learned—secure the “all” email group and any email group that can forward to large groups of people. This is privileged access, just in an untraditional form, within an application. As with any privileged access, it should be managed and locked down.

Every modern HID has attack vectors, from default credentials through missing access control lists governing who can even access the device. For example, printing to a device located within the human resources or finance departments potentially allows insiders to access any other documents that may be unintentionally left on the printer. Default credentials, even for network management, can provide access to duplicate print jobs to a malicious destination, including storing them on the device’s internal storage for later retrieval via protocols like FTP. Each of these is a form of privileged access to a potentially sensitive device. These devices should be hardened for management and usage. In fact, just as a matter of reference, any device that is being deployed in your environment that is considered “smart” HID, like TVs and projectors, can suffer from similar types of privilege flaws, including monitoring a screen when a meeting may be considered private.

Privileged access can actually mean anything from physical access to remote access that a vendor or supplier can have in order to maintain or provide some form of service into your, or their, environment. Many times, these are in the form of accounts that can be managed with an identity governance or privileged access management solution, but, often, organizations create an account in their domain, and then email or text the credentials (including the password) to the third party in order to grant access. The security of this is questionable at best. If you think this not an issue, think again. I personally closed an account in a major software vendor that was created almost 20 years ago and that still allowed me to gain access to license keys and software from my old employer. Access was still granted via my old email address, a compromised weak password, and a vendor and company that did not bother to clean up vendor access—even when employees left the organization. Obviously, the access was not administrative or root, but I did have enough access into material I should not have had. This is a privileged activity and should be managed. Certifying access for your vendors is critical to helping ensure that no inappropriate access occurs.

​Take an Expansive View to Securing Your Universe of Privileges

The universe of privileges encompasses much more than administrator and root credentials. It can even apply to abstract concepts, like email groups, human interface devices, and vendor access.

The three privilege risks I detailed above are present in most organizations and need to be properly addressed. If you think you may be at risk, just start asking a few questions. Who has access to large email groups, does everyone have access to a printer or projector, and how do you manage vendor access, especially during employee or vendor turnover and transitions? This simple exercise may lead you down a more comprehensive privilege discovery process, helping you uncover all the places unmanaged privileged access lurks across your organization. With the knowledge of where privilege resides in hand, you can then implement mitigations to close backdoors into your environment and limit lateral passageways between assets—reducing your threat surface and eliminating security weak links.

BeyondTrust has the industry’s most expansive approach to securing privileged access. Via our Universal Privilege Management model, we secure every user, session, and asset across your IT environment. Learn more in this white paper, or contact us today.


Whitepapers

Universal Privilege Management: The Journey to Securing Every Privilege, Every Time

Videos

Universal Privilege Management: The Journey to Securing Every Privilege, Every Time

Morey J. Haber, Chief Technology Officer and Chief Information Security Officer at BeyondTrust

Morey J. Haber is Chief Technology Officer and Chief Information Security Officer at BeyondTrust. He has more than 25 years of IT industry experience and has authored four Apress books: Privileged Attack Vectors (2 Editions), Asset Attack Vectors, and Identity Attack Vectors. In 2018, Bomgar acquired BeyondTrust and retained the BeyondTrust name. He originally joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition. Morey currently oversees BeyondTrust strategy for privileged access management and remote access solutions. In 2004, he joined eEye as Director of Security Engineering and was responsible for strategic business discussions and vulnerability management architectures in Fortune 500 clients. Prior to eEye, he was Development Manager for Computer Associates, Inc. (CA), responsible for new product beta cycles and named customer accounts. He began his career as Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelor of Science degree in Electrical Engineering from the State University of New York at Stony Brook.

Stay Up To Date

Get the latest news, ideas, and tactics from BeyondTrust. You may unsubscribe at any time.

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

Up next

From May 15, 2020:
Is Cybersecurity Insurance Leading to More Lax Security?
From May 20, 2020:
The Effectiveness of Identity-Based Security Controls on Breach Reduction: What New IDSA Research Spells Out

You May Also Be Interested In:

Whitepapers

A Zero Trust Approach to Secure Access

Whitepapers

A Zero Trust Approach to Windows & Mac Endpoint Security

Whitepapers

KuppingerCole Executive Review - BeyondTrust Endpoint Privilege Management

BeyondTrust Logo
  • Facebook
  • Twitter
  • LinkedIn

Keep up with BeyondTrust

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

Customer Support
Contact Sales

Products

  • Endpoint Privilege Management
  • Password Management
  • Privileged Remote Access
  • DevOps Secrets Safe
  • Remote Support

Resources

  • Blog
  • Case Studies
  • Competitor Comparisons
  • Datasheets
  • Glossary
  • Videos
  • Webcasts
  • Whitepapers

About

  • Company
  • Careers
  • Contact
  • Events
  • Leadership Team
  • Partner Program
  • Press

Languages

  • English
  • German
  • French
  • Spanish
  • Korean
  • Portuguese
  • Japanese
  • Privacy
  • Security
  • Manage Cookies
  • WEEE Compliance

Copyright © 1999 — 2020 BeyondTrust Corporation. All rights reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust Corporation is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.