Security Strategies: Controlling Privileged Account Access

Transcription

1 Security Strategies: Controlling Privileged Account Access Privileged Account Management: Are you in control? Denis Mekinda 2011 Quest Software, Inc. ALL RIGHTS RESERVED

2 Who knows what? Can you be sure? 2

3 How strong is a strong password? 3

4 Where do we have to worry about the keys to the kingdom problem? All direct administrator access Controlling remote vendor access Enabling developer access to production Managing the issuance and approval of credentials Enabling separation of duties Providing limited rights for daily administrative tasks Managing a sudo environment Many, many more 4

5 I have procedures in place... User creation procedures Auditing Roles Based Access Control Identity management solutions Automation Leavers process (deprovision) Trusted teams 5

6 Identity & Access Management Typically these tools address end-user account activities Provisioning users De-provisioning users Managing login activity Granting single sign-on rights 6

7 But......They are NOT designed to identify and manage privileged identities Shared/privileged accounts are typically not associated with a specific individual 7

8 Quest One Identity Solution 8

9 Quest solves common challenges around managing privileged accounts through a broad set of solutions across heterogeneous systems 9

10 The Challenge: Managing Privileged Accounts Privileged accounts exist everywhere Auditing privileged user sessions Network Devices Databases Privileged Passwords Operating Systems Privileged Sessions Applications Virtual Platforms 11

11 Total Privileged Access Management (TPAM) Suite A product Suite designed to solve security and compliance issues associated with privileged users and privileged access Modular design allows flexibility to grow Start with required base modules Add additional modules as needs change 12

12 Privileged Password Management Issues and Challenges Privileged Accounts are typically UBIQUITOUS Unlike User accounts, no individual association Many times have known default passwords Privileged Accounts exist in every system, network device, database, etc. Privileged Accounts have extensive ACCESS and CONTROL Many times full system access and control Configuration and audit controls Regulatory and Compliance AUDIT ISSUES Privileged/Shared/Service/Application account management growing audit area What was acceptable yesterday is NOT accepted today 13

13 Privileged Password Management Enterprise Requirement Secure Dual release control Change Controls Enterprise Integration TPAM Suite/PPM Module Extensive built-in security Password encrypted via RSA Bsafe Full Disk encryption via Guardian Edge Embedded hardware firewall Purpose built appliance Dual or more release controls Extensive configurable change control Time based (every X days) Last-use based Force change Extensive integration with Strong authentication solutions Active Directory Ticketing systems 14

14 Privileged Password Management Enterprise Requirement Effective workflow Ease of deployment & integration Small screen support example TPAM Suite/PPM Module TPAM Workflow values Web-base client access Role-based Dual authorization controls based notifications Robust small screen support Robust CLI/API Installed & configure in one day Drop-in appliance Client/agentless deployment Tight integration w/ad Import via.csv Full API/CLI Audit, SNMP, Syslog 15

15 Application Password Management Embedded/Hard-coded passwords represent an often hidden exposure Accounts/passwords known to programmers Back-door accounts Issues and Challenges Application requirements can vary widely Continuous A2A connectivity Transaction A2A connectivity 16

16 Application Password Management Enterprise Requirement Replace Embedded Passwords Support High Demand transaction type applications TPAM Suite/APM Module Full API/CLI C/C++ Java.NET Perl PAR Cache Add-on capability Available as Cache appliance or VM Supports central or distributed needs Over 500 requests/second 17

17 Privileged Session Management Issues and Challenges Compliance often drives the need to know WHAT was done during certain privileged or sensitive access do you need to know exactly what as done by: Remote Vendors? Outsourced service providers? Developers granted access to production systems? Fire-call activities? Users or admins accessing sensitive resources or applications (Financial/Sox servers, HR, etc.) Certain access demands higher audit and control Need to restrict direct resource access 18

18 Privileged Session Management Enterprise Requirement TPAM Solution/PSM Module Fine grain access control User control point Limits resource view based on role Connection controls Session Audit Full control over connections Dual authorization controls Session time limits Alarm notification session overrun Manual session termination options Unmatched session audit Audit/log all connection requests, approvals FULL session recording with DVR replay 19

19 Privileged Session Management Enterprise Requirement Strong Audit TPAM Suite/PSM Module Unmatched session audit Audit/log all connection requests, approvals Full Session Recording and Replay of ALL activities DVR Style Replay Control 20

20 Workflow Session Request Request a session connection Enter date/time/duration of connection request. Can request for future date/time to allow advanced approval if under dual authorization control. Once connection approved (or auto approved) simply CONNECT! Select from a list of systems and accounts the specific user has authorization to request connections too. 21

21 Workflow Session Request User connected and performs required work Session can be configured for interactive or auto-login EVERY action on the target system will be recorded (Keystrokes, mouse, links, etc.) If user session extends beyond requested time, configurable alert notifications of session overrun can be sent Connection proxy created to selected System and Account Active sessions can be manually terminated by authorized administrators 22

22 Workflow - Session Replay All session activity is recorded and viewable Via session replay. Recording are NOT AVI type files recording size is compressed and VERY manageable. DVR- Style controls allow control of replay of Recorded sessions. 23

23 Privileged Command Management Issues and Challenges Strong compliance need to restrict Superuser privilege access Need to grant superuser rights without full superuser control Need to restrict what remote vendors or services providers can do Reduction in staff driving a need to do more with less Need to delegate certain privileged functions without granting total privileged control Need support across both Unix and Windows platforms 24

24 Privileged Command Management Enterprise Requirement Superuser Privilege Management (SUPM) Support multi-platform environments TPAM Solution/PCM Module SUPM Values Command level access controls No ability to execute outside of command limit Record all activity Session Restricted to Single Command (this example Computer Management) TPAM supports PCM for: Unix Windows Others (coming in future release) No other Windows functions available 25

25 Workflow Command Limited Session Session is to back-end target/account (Windows A3/e22egp) via PCM, user session is established and user is placed into the specific command. In this example, Computer Management. No access to other target commands, menu s, etc. is allowed. The session will only exist within the context of the specific command (eg. Computer Management). Once the user exits the command, the session is immediately terminated. 26

26 TPAM Workflow Overview 27

27 TPAM Summary 28

28 TPAM Summary 29

29 Questions? Patrick Hunter Solutions Architect 30