With the proliferation of infrastructure components that have moved to web-based management interfaces in the Cloud, information and security technology administrators are faced with new threats for managing credentials to administer these solutions.
It's a challenge to control, audit, and enforce proper authentication for privileged access to browser-based cloud resources without negatively affecting business productivity. Administrators, and even power users, need a way to effectively control and audit resources managed via cloud-based web consoles, including:
- Externally hosted infrastructure as a service (IaaS) servers and services, such as Amazon AWS, Microsoft Azure, Google Cloud, and Rackspace
- Software as a service (SaaS), such as SalesForce, ServiceNow, Mvision, and IdentityNow
- Corporate social media accounts like LinkedIn, Twitter, and Facebook
The identity and access management (IAM) capabilities vary significantly between SaaS, IaaS, and social media systems. Some of these platforms do not offer native multi-factor authentication support, multiple administrative accounts, nor well-defined role-based or attribute-based access models (RBAC and ABAC). Virtually none of these platforms provide built-in session monitoring capabilities, which is essential to ensure security, auditability, and accountability. Session monitoring capabilities are also required for many regulatory compliance initiatives to certify privileged activity. These inconsistencies and cloud security deficiencies across cloud-based platforms create dangerous opportunities for the misuse of accounts and access, which can result in the leaking of sensitive data, or potentially hijacked resources.
Addressing Key Privileged Access Security & Accountability Gaps in the Cloud
BeyondTrust Web Jump can address these privileged access security gaps in the Cloud by providing a layer of security for authenticating to these systems with full session monitoring capabilities. It is a Chromium-based browser embedded in a bastion host (proxy) that can access a web-based resource remotely and automatically inject secure credentials—completely invisible to the end-user and without ever revealing the password—to access those resources in a controlled manner.
By applying other security best practices, like access control lists (ACLs), environments can ensure that the Web Jump interface is only authorized source into cloud resources, thereby blocking any rogue or suspicious activity, while forcing all user activity through a trusted browser. This also obviates the need for a virtual desktop environment to act as terminal server or gateway just to host a browser in order to make this connection. This setup can be used for on-premise, web-based administration solutions as well to enforce proper network zoning and segmentation in the cloud.
BeyondTrust’s Web Jump is a component of a Jump Point and available in BeyondTrust’s Secure Remote Access technology. BeyondTrust Secure Remote Access (comprised of Privileged Remote Access and Remote Support solutions) enables organizations to secure, manage, and audit vendor, administrator, and helpdesk remote access activity, both on-premise and in the cloud. This can all be achieved without the need for a VPN (Virtual Private Network) or other tunnelling technology
In addition, with Privileged Remote Access, organizations can extend access to important assets in the cloud, or deep within an organization, using Jump Points and adhere to security best practices by limiting network traffic and ports to only authorized sources and applications.
BeyondTrust can help secure your cloud-based web resources and mitigate the threats from privileged attack vectors and credential-based attacks. For more information on Secure Remote Access and Web Jump, contact us today.
Related Reading
Despite Recent Breaches, the Cloud is not Falling
RDP: The Risk of Remote Desktop Protocol is far from “Remote”
4 Ways Privileged Access Security Tools can Prevent a Third-Party Breach
Morey J. Haber, Chief Security Officer, BeyondTrust
Morey J. Haber is the Chief Security Officer at BeyondTrust. He has more than 25 years of IT industry experience and has authored four books: Privileged Attack Vectors, Asset Attack Vectors, Identity Attack Vectors, and Cloud Attack Vectors. He is a founding member of the industry group Transparency in Cyber, and in 2020 was elected to the Identity Defined Security Alliance (IDSA) Executive Advisory Board. Morey currently oversees BeyondTrust security and governance for corporate and cloud based solutions and regularly consults for global periodicals and media. He originally joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition where he served as a Product Owner and Solutions Engineer since 2004. Prior to eEye, he was Beta Development Manager for Computer Associates, Inc. He began his career as Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelor of Science degree in Electrical Engineering from the State University of New York at Stony Brook.
