A well-designed Privileged Account Security (PAS) management program should include procedures for recognizing threats and descriptions of the most common methods of attacks and system intrusions. When building such a program, it is worth answering the question "Where to start"? A good place to start might be with external audit activities, a dedicated security meeting, customer notifications, or requests from the business to set up appropriate procedures.
It's worth reviewing good and proven practices for building your own security plans. Here are 5 key recommendations that allow IT departments to improve security, and that can minimize the risk of threats, which will translate into measurable savings over time IT companies In terms of investment in security technologies.
ISCG recommends:
Recommendation #1: Reduce access rights to critical systems and domain controllers.
This action should go hand in hand with multi-level authentication and identity management system to continuously monitor systems and quickly detect known suspicious processes (e.g., Mimikatz). Using multiple layers of protection strengthens security and minimizes the risk of network takeover. Cybercriminals often take advantage of poor security and excessive privileges assigned to individual accounts, so that a single access guarantees their ability to cause damage in multiple areas. Setting clear rules and privilege boundaries will effectively minimize the damage caused by both external and internal attacks on the IT infrastructure.
Recommendation #2: Remove local Administrator accounts and run procedures for securely checking access to applications, especially for accounting, development, domain control or workstation systems.
Cybercriminals often impersonate a user's account beforehand with a phishing attack, to which end users in specific company departments are particularly susceptible. Once the account has been taken over, hackers can not only inject malicious code, but also grant themselves higher privileges to access more critical resources. These actions are the bane of many organizations, which do not always create lists of trusted applications and access to them (Whitelisting), granting privileges to outsiders or temporary employees. In addition, removing access rights from high-level employee accounts is not easy, significantly increasing the risk of attacks.
It's worth setting clear policies to filter application access and remove excessive administrator rights on network ends. This action can prove salutary for the security of sensitive information stored in privileged accounts.
Recommendation #3: Set random passwords for Administrator accounts on Windows, UNIX or Linux systems.
A common pain point for companies is regularly changing passwords for privileged accounts. Even when passwords are updated, they are often the same for all endpoint devices. This allows hackers to steal identities and use them to access critical resources stored on laptops, desktops or servers. It is worthwhile to use unique accesses and complex, frequently changed, passwords. This will minimize the potential use of "back doors" of entry into the system.
Recommendation #4: Protect and change critical accounts with the highest access to systems and applications regularly.
Critical accounts and keys should be used dynamically and changed frequently. Typical examples of applications for which to use this method are:
- QualysGuard, Rapid7, Tenable Nessus and McAfee Vulnerability Manager to manage password protection and resilience
- Self-motivation systems such as Puppet, Ansible, Jenkins, Docker or EC2
- Service-Now Discovery, HP Universal Discovery I ForeScout CounterAct Systems
These systems often run continuously, outside of standard IT department working hours, making manual password changes and rotation not always possible. Failure to change security policies can result in an attacker using these applications to gain access to higher levels and infiltrate the organization's structure from within. It is a good idea to use access and account management templates for these applications so that appropriate security policies can be quickly triggered if necessary.
Recommendation #5: Enhance security by applying higher levels of protection to the Data Center using virtual consoles and separate keys for the public and private cloud.
Most public cloud providers, e.g. AWS (Amazon Web Servics), provide companies with a specific set of keys without the ability to change them. To steal these keys is to risk entering the system and gaining access to critical accounts and identities. If an attacker gains access to a system using the Virtual Console, he will have bought himself time to, for example, copy the systems contents and save them in a location known only to himself. This is a single point of failure that, in the wrong hands, can cause significant damage to any company
Regularly changing the storage location, access levels and password rotation for privileged accounts will enable organizations to have more control over privileged accounts and reduce the risk of theft. It's worth logging in
and record all login sessions - the information gleaned from these can be helpful in preparing and implementing solutions to recover needed data and account accesses in the event of a system failure or hack.
You can also do your own analysis of the privileged accounts you use. We described the method in the blog at: https://www.iscg.pl/dna/
Source: https://www.cyberark.com/
Need additional support? Get a free consultation with an ISCG expert and learn how to enhance your security experience.