How to Cure a Bloated Enterprise Attack Surface? PAM with Least Privilege

All of us have developed a measure of personal risk surrounding multiple points of vulnerability. Those vulnerability points include access to our dwellings, accounts, and applications we’ve downloaded for entertainment, business, social media, and smart devices for home management.

We rely upon passwords we’ve created of varying protective strength to safeguard these access points. We often utilize the same phrase or code for multiple applications, or share them between family members. And how many of us store our passwords in the Notes app on our smartphones?

In the case of our homes, how do we facilitate access? We often hand out keys to friends and family members. We may hide keys near the front door in case of emergencies, believing our hiding spot is immune to malicious discovery. Many of us employ the services of pet-sitters, house cleaners, and repairmen. We typically entrust these individuals with a key, allowing them full access to our personal space and its contents. We assume that only those activities and permissions we grant while they are in our home will be acted upon. Whether that key allows a one-time use, or grants regularly scheduled visits, we are relying upon responsible behavior and the protection of that key. We trust that it will not be shared with others without our explicit permission.

The unsettling reality is that we often arm too many outsiders and careless insiders with keys to our kingdom, instead of developing a tighter security process that protects our treasured assets.

The pitfalls of poorly controlled privileged access

While a keyless entry system on the front door might somewhat alleviate the house key over-provisioning security dilemma, there are still issues regarding who and how many access privileges are extended; and for how long. These are issues enterprise security teams must deal with every day, when granting privileged access to their servers, apps, services and networks.

What are privileges in this context? They are special elevated access rights or benefits to highly sensitive assets not given to the masses. These privileges can be granted via the use of credentials, keys, secrets, passwords and permissions across accounts, applications, servers, devices and systems for daily as well as specialized activities. The greater percentage of users, within standard and guest user accounts, are in the non-privileged category. But within IT and for specialized personnel, elevated access and permissions are granted to highly sensitive enterprise systems and assets.

According to Forrester Research, at least 80% of security breaches involve highly privileged credentials; illuminating the risks and threats surrounding access permissions and password protection. Without a cohesive approach to the management and control of access and permission privileges, an enterprise will remain in a heightened state of vulnerability to malicious hackers, rogue insiders, and user carelessness.

Privileged access vulnerability issues

• Lack of awareness of all privileged users, accounts and credentials, including forgotten and orphaned accounts of former employees, creates dangerous backdoors for malicious actors.
• Hard-coded/default credentials are often embedded in applications, network devices and loT that pose a risk if not removed.
• Decentralized or siloed credential and identity management tools and processes, often running on multiple platforms, create unnecessary complexity for IT and friction for users, while increasing risk.
• Password and account sharing within IT teams of root and other privileged credentials for convenience creates security gaps and heightened vulnerability to the most sensitive data.
• Over-provisioning of privileges creates an unnecessary increase in the number of potential and poorly controlled access points, creating a highly bloated attack surface.

The answer to eliminating unnecessary security vulnerabilities and complexity related to privileged access is to condense attack surfaces and limit the scope of threats by applying least privilege best practices and centralized privileged access management (PAM).

PAM and least privilege best practices will shrink bloated enterprise attack surfaces

This may sound contradictory, but the most effective and secure way to extend privileges is to first eliminate existing privileges. Then apply a new rules-based best practices policy, removing all admin access rights to servers and endpoints, eliminating default privileges, and limiting everyone to a standard user level. Then apply least privilege policies that grant elevated privileges as needed, per request and approval. Privileged access should have a time limit and the access revoked after the specific activity is completed. Least privilege should be enforced over end users, endpoints, applications, services, servers and accounts.

Privileged access should be a limited right, not a default expectation. Every enterprise should seek to tighten security around the use and misuse of passwords, credentials, and keys in order to condense the attack surface against careless and malicious actors.

A comprehensive PAM strategy, utilizing an intuitive and automated platform, can inventory and classify all privileged accounts and credentials, monitor how access is provisioned and de-provisioned, and provide visibility into where and how credentials are being used. The solution should enable centralized visibility and control, to discover and eliminate orphaned accounts and repetitious passwords or inappropriate password sharing, and SSH keys used across multiple servers. A centralized ‘vault’ holds credentials, and a check-out/check-in process allows for tight control, management and monitoring.

An enterprise can decrease the pathways and access points for external and internal threats by limiting and controlling privileges for all users, processes and apps. Least privilege best practices and a fully automated privileged access management solution can greatly reduce the propagation of malware infections, limiting the scope of potential breaches. PAM can greatly optimize operational performance, while reducing complexity that creates user friction, to achieve easier compliance and enhanced system security. A mature, fully automated PAM solution enables tight control over the who, what, where, and how of access privileges, with complete insight into all activity, greatly reducing an enterprise’s vulnerability quotient.

Originally published at https://revbits.com on September 13, 2022.