Hackers are very fond of privileged accounts. These can be service accounts that require higher privileges, local administrators or, finally, the domain. As soon as they gain access to them, they can escalate the level of damage by giving themselves additional privileges on the system. Intercepting the privileged credentials of an authorized user allows an attacker to easily blend in with legitimate network traffic, which is extremely difficult to detect.
Facts? According to 63% post-breach analysis reports, intrusions occur by taking control of privileged accounts, and hackers can remain on the network undetected for up to 240 days before an attack occurs. This condition spends the sleep of many a security officer. What can help?
There's just... 5 things to live for: 5 security tips as an essential resource for every IT professional.
It is worthwhile to read 5 tips that show in a clear and transparent way how to effectively increase the security of an organization while maintaining compliance with security policies.
Tip #1: Which computers no longer belong to Active Directory?
Identify Windows systems not recently connected to the root domain, expired or non-existent.
Tip #2: Which privileged accounts are inactive?
Look for which access rights cannot be verified or are not up to date. Mechanisms integrated within the privileged account management suite allow you to see which access credentials (logins
and passwords) in external systems are correct. You can use the free Cyberark DNA tool. We describe how to download it on our blog (https://www.iscg.pl/dna/).
Tip #3: Who hasn't logged in in the last 90 days?
Quick view of user accounts that have not logged into the system in the last 90 days. Any admin can generate such a report for AD accounts. You can also get such a report using the free Cyberark DNA. The report allows you to identify company personnel who no longer need access to privileged accounts.
Tip #4: Compliance and correct operation of password security policies for privileged accounts
A full view of all accounts with access rights with additional information about password structure or configuration changes, among other things. It is important that this report is used periodically to monitor and verify possible changes made by unauthorized personnel.
Tip #5: Keep your systems and applications up to date
If already privileged accounts are secured, there are fewer of them, passwords complex with rotation, introduce mechanisms to eliminate application and system vulnerabilities that lead to privilege escalation.
ISCG advises:
Above all, it is worth using such systems that provide not only security mechanisms for managing access to privileged accounts, but also offer advanced diagnostic and reporting tools for those in charge of security policy in the company. Download Cyberark DNA from us and check in a secure and trusted way where you have privileged accounts and what they have access to. Read more in the article "5 Simple Steps to Securely Manage Access for Privileged Accounts." HERE.
ISCG recommends:
- Use the principle of least privilege - you reduce the risk of unauthorized access to systems.
- Run regular reports - this is a source of invaluable information that you won't read with a simple system review.
- Set alerts and notifications - you'll be one step ahead of the potential threat of hacking as a result of unauthorized access.
- Have your system audited periodically - let certified professionals look at your system from the side - they can see and read more than what the reports show.
- Hold regular safety training sessions - you can never have too much such knowledge!
- Add yourself to our group on LN or FB and read the additional Privileged Account Security 5 recommendations report.
Do you need support? Get a free consultation with an ISCG expert and learn how to increase your security comfort. Fill out the form below and we'll get back to you.