Credential Management

With the significant increase in the number of malware and ransomware cases worldwide, ensuring the security of your company’s privileged credentials has become a fundamental practice to protect it against insider threats, data leaks, and immeasurable financial losses.

For this purpose, there are several ways to protect yourself, such as implementing Privileged Access Management (PAM) solutions. What many people do not know is that implementing any PAM solution in your corporation will not guarantee the protection of your company’s privileged credentials.

Your solution must have several functionalities that secure privileged credentials aligned to a good information security strategy.

To help with this task, we have chosen some essential functionalities that your PAM solution must have in order for you to guarantee the security of your company’s privileged credentials.

How Important is It to Keep Privileged Credentials Secure?

With the digital transformation boosted through the growing adoption of cloud-based models, connected devices, and development strategies, there has also been an explosion of privileged credentials associated with these devices. Gartner estimates the number of IoT and Industrial IoT devices to reach 24 billion this year.

No wonder they are called “keys to the kingdom”, as they allow access to valuable information from the organization and which are often targeted by cybercriminals.

According to Verizon in its Data Breach Investigations Report 2021, 61% of data leaks involved privileged credentials. What’s more, according to IBM’s Cost of a Data Breach 2020 report, the cost of a cyberattack involving privileged credentials is USD 4.77 million, 23.5% more than the average.

So, properly protecting privileged credentials is essential in the cybersecurity strategies of companies of all sizes and verticals. In addition, the information security teams must protect these “keys” from malicious attackers, granting access in a secure way and properly monitoring the actions performed in the environment through privileged access.

Privileged Access Management (PAM) is all about protecting those high-privileged accounts, credentials, and operations. Gartner itself elected PAM for two years in a row as the number one project in Security. And still according to Gartner, managing privileged access risks is virtually impossible without specialized PAM tools.

What Are the Main Types of Privileged Credentials?

Through privileged credentials, significant changes can be made to devices and applications installed on an infrastructure, which in many cases can affect business continuity.

The impact of using them maliciously can cause serious damage, from violations of compliance items, which can lead to heavy penalties, to security incidents – which result in reduced trust by the interested parties and lost revenue.

Discover the main types of privileged credentials that are most common in corporate environments.

Local Administrator Accounts
We are all very familiar with the local administrator account that is automatically created when installing a Windows computer. The account provides complete control over files, folders, services, and local user permissions management. Local administrators can install any software, modify or disable security settings, transfer data, and create any number of new local administrators.

Local accounts with administrator privileges are considered necessary to perform system updates, software and hardware upgrades. They are also useful for gaining local access to machines when the network goes down and when your organization has some technical issues.

Privileged User Accounts
In an IT environment, privileged user accounts are those that are given comparatively more privileges or permissions than a normal user account.

Any malicious activity carried out by a privileged account, either intentionally or by mistake, can be a threat to IT security. To address this, you need a systematic way to determine which users have privileged access and track their activities.

For example, Active Directory has built-in privileged groups for privileged accounts. These groups are: Admins, Domain Admins, Enterprise Admins, Schema Admins, DnsAdmins, and Group Policy Creator Owners.

Domain Administrator Accounts
A domain administrator is essentially a user who is authorized to make global policy changes that affect all computers and users connected to that Active Directory organization. They are allowed to go anywhere and do anything, with the limitation that they must remain within that specific account.

Service Accounts
Service accounts (or app accounts) are a digital identity used by an app or services to interact with other apps or the operating system. The service accounts can be a privileged identity in the context of the application.

The main features and functionalities of a service account are:

• They are used by applications to access databases, run batch tasks or scripts, or provide access to other applications.
• These privileged identities often have broad access to the underlying enterprise data storage that resides in applications and databases.
• Passwords for these accounts are often embedded and stored in plain text files, a vulnerability that is replicated across multiple servers to provide greater fault tolerance for applications.
• This vulnerability poses a significant risk to an organizational entity because applications often host the exact data that advanced persistent threats deem to be an item of interest.

Local service accounts can interact with a variety of operating system components, making it difficult to coordinate password changes. This challenge often means that passwords are rarely changed, which represents a significant security consideration within a company.

What Is the Credential Management Lifecycle?

The entire Privileged Access Management process must be considered by those responsible for Information Security in companies, from the discovery of assets, credentials, and digital certificates and access provisioning to the visibility of actions performed in the environment, going through the management of privileges and the access itself, when the privileged actions are actually performed.

Thus, it is possible to consider the Privileged Access Management process in a lifecycle, which we call the privileged access lifecycle.

Before
In order to have a broad and efficient privileged access management, it is necessary to pay special attention to the initial phase of managing privileged credentials.

This phase is responsible for provisioning and guaranteeing access to certified machines and privileged credentials through digital certificates, passwords, SSH keys. Therefore, it is really important.

During
This is the part where privileged access management actually takes place, making it possible to track all user activities in the privileged session in real-time, monitor, and analyze suspicious behaviors from users and machines, etc.

Having a solution that can define and limit the tasks that a privileged session will be allowed to perform is essential for your company’s information security to succeed.

After
After performing the two previous phases, your privileged access management solution must record every action taken in the privileged session. Through this audit, your company ensures that, during the sessions, there are no security breaches, can record all actions performed by users