Free Privileged Account Discovery Tool: Identify & secure credentials to stop lateral movement. Download Free

BeyondTrust
  • Products
    Privileged Password Management
    Discover, manage, audit, and monitor privileged accounts
    Password Safe DevOps Secrets Safe
    Endpoint Privilege Management
    Manage privileges on Windows, Mac, Linux, and Unix endpoints
    Windows and Mac Unix and Linux Active Directory Bridge
    Secure Remote Access
    Centrally manage and secure remote access for service desks and vendors
    Remote Support Privileged Remote Access
    BeyondInsight Analytics
    See All Solutions
  • Resources

    Universal Privilege Management

    Our innovative Universal Privilege Management approach secures every user, asset, and session across your entire enterprise.

    Watch Video

    Learn

    Case Studies
    Competitor Comparisons
    Datasheets
    Glossary
    Product Demos
    Whitepapers

    Attend

    Events
    Go Beyond
    Training
    Webinars

    Support

    Changelog
    Professional Services
    Technical Documentation
  • Blog
  • Partners
  • Contact
  • Support
  • Services
  • Training
  • Events
  • Company

Using least privilege to achieve compliance: The dual benefit

October 20, 2017

  • Blog
  • Archive

What do the guidelines of PCI DSS, FDCC, SOX and HIPAA have in common? These mandates, in addition to other commonly implemented regulations, either explicitly demand or at least suggest the use of least privilege security to effectively safeguard data. In terms of compliance, this methodology has a dual benefit – not only does it satisfy auditors, but it will also protect against security breaches that could result in destructive data loss.

As regulatory bodies continue to dictate security initiatives within heavily-regulated industries such as finance and healthcare, least privilege management will play a key role in ensuring companies are in line with internal and external rules. For instance, the Monetary Authority of Singapore (MAS) has Technology Risk Management guidelines, which now place much greater emphasis on endpoint security, particularly with regard to access privileges.

These guidelines now apply to all IT systems among all financial institutions, where they had previously only applied to online services in banking.

As today’s security threats become increasingly sophisticated and targeted, it’s to be expected that least privilege will play a more significant role in mitigating risk as well as helping an organization to achieve compliance. Already, we’re seeing it become more widespread as an essential security measure among a greater variety of sectors and practices.

The MAS guidelines detail a number of system requirements – such as limiting exposure to cyber and man-in-the-middle attacks – that would be very difficult to achieve without a least privilege environment. In fact, the document presents one section dedicated entirely to least privilege. Here, requirements encourage restricting the number of privileged accounts and only granting them on a ‘need-to-have’ basis. The guidelines also encourage the close monitoring of those who are given elevated rights, with regular assessments to ensure they are always appropriately assigned. The principle of “never alone” – where activities involving sensitive information must be jointly carried out by more than one person or performed by one person and authorized by another – may also create challenges for IT teams.

The PCI DSS compliance mandate which was updated in January 2014 (PCI DSS 3.0) has a specific requirement to log activity of privileged users and states that employees with privileged user accounts must be limited to the least set of privileges necessary to perform their job responsibilities.

So, why is it that least privilege is so heavily prescribed in widespread mandates like MAS and PCI DSS? The danger of granting privileges to staff is that it puts them in a good position to implement sophisticated attack methods like logic bombs and stealth scripts, or enable them to crack passwords. Even without malicious intent, staff with elevated privileges could unknowingly introduce malware through unauthorized application downloads.

Organizations that prioritize privilege management won’t just meet compliance, but improve their overall security architecture. Being compliant doesn’t mean you’re secure, but many of the prescribed elements – such as least privilege – will vastly improve your security and provide you with a solid base to build upon.

For more information on achieving compliance, download our whitepaper.

Andrew Avanessian

Stay Up To Date

Get the latest news, ideas, and tactics from BeyondTrust. You may unsubscribe at any time.

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

You May Also Be Interested In:

Webcasts | February 09, 2021

Customer Webinar: Remote Support 21.1 Released!

Webcasts | February 24, 2021

Your PAM 2021 Blueprint: Securing Privileged Accounts for On-Premises and Cloud Assets

Whitepapers

Evolving Privileged Identity Management (PIM) In The 'Next Normal'

BeyondTrust Logo
  • Facebook
  • Twitter
  • LinkedIn

Keep up with BeyondTrust

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

Customer Support
Contact Sales

Products

  • Endpoint Privilege Management
  • Password Management
  • Privileged Remote Access
  • DevOps Secrets Safe
  • Remote Support

Resources

  • Blog
  • Case Studies
  • Competitor Comparisons
  • Datasheets
  • Glossary
  • Videos
  • Webcasts
  • Whitepapers

About

  • Company
  • Careers
  • Contact
  • Events
  • Leadership Team
  • Partner Program
  • Press

Languages

  • English
  • German
  • French
  • Spanish
  • Korean
  • Portuguese
  • Japanese
  • Privacy
  • Security
  • Manage Cookies
  • WEEE Compliance

Copyright © 1999 — 2020 BeyondTrust Corporation. All rights reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust Corporation is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.