Using Secure Remote Access as a Bastion Host for Cloud-Based Access

With the proliferation of infrastructure components that have moved to web-based management interfaces in the Cloud, information and security technology administrators are faced with new threats for managing credentials to administer these solutions.

It's a challenge to control, audit, and enforce proper authentication for privileged access to browser-based cloud resources without negatively affecting business productivity. Administrators, and even power users, need a way to effectively control and audit resources managed via cloud-based web consoles, including:

Externally hosted infrastructure as a service (IaaS) servers and services, such as Amazon AWS, Microsoft Azure, Google Cloud, and Rackspace
Software as a service (SaaS), such as SalesForce, ServiceNow, Mvision, and IdentityNow
Corporate social media accounts like LinkedIn, Twitter, and Facebook

The identity and access management (IAM) capabilities vary significantly between SaaS, IaaS, and social media systems. Some of these platforms do not offer native multi-factor authentication support, multiple administrative accounts, nor well-defined role-based or attribute-based access models (RBAC and ABAC). Virtually none of these platforms provide built-in session monitoring capabilities, which is essential to ensure security, auditability, and accountability. Session monitoring capabilities are also required for many regulatory compliance initiatives to certify privileged activity. These inconsistencies and cloud security deficiencies across cloud-based platforms create dangerous opportunities for the misuse of accounts and access, which can result in the leaking of sensitive data, or potentially hijacked resources.

Addressing Key Privileged Access Security & Accountability Gaps in the Cloud

BeyondTrust Web Jump can address these privileged access security gaps in the Cloud by providing a layer of security for authenticating to these systems with full session monitoring capabilities. It is a Chromium-based browser embedded in a bastion host (proxy) that can access a web-based resource remotely and automatically inject secure credentials—completely invisible to the end-user and without ever revealing the password—to access those resources in a controlled manner.

Using BeyondTrust Web Jump to address privileged access security gaps in the Cloud

By applying other security best practices, like access control lists (ACLs), environments can ensure that the Web Jump interface is only authorized source into cloud resources, thereby blocking any rogue or suspicious activity, while forcing all user activity through a trusted browser. This also obviates the need for a virtual desktop environment to act as terminal server or gateway just to host a browser in order to make this connection. This setup can be used for on-premise, web-based administration solutions as well to enforce proper network zoning and segmentation in the cloud.

BeyondTrust’s Web Jump is a component of a Jump Point and available in BeyondTrust’s Secure Remote Access technology. BeyondTrust Secure Remote Access (comprised of Privileged Remote Access and Remote Support solutions) enables organizations to secure, manage, and audit vendor, administrator, and helpdesk remote access activity, both on-premise and in the cloud. This can all be achieved without the need for a VPN (Virtual Private Network) or other tunnelling technology

In addition, with Privileged Remote Access, organizations can extend access to important assets in the cloud, or deep within an organization, using Jump Points and adhere to security best practices by limiting network traffic and ports to only authorized sources and applications.

BeyondTrust can help secure your cloud-based web resources and mitigate the threats from privileged attack vectors and credential-based attacks. For more information on Secure Remote Access and Web Jump, contact us today.

RDP: The Risk of Remote Desktop Protocol is far from “Remote”

4 Ways Privileged Access Security Tools can Prevent a Third-Party Breach