http://www.hcltech.com/it-infrastructure-management/overview-More on Infrastructure Management This white gives an insight to the Privileged Access Challenges and the benefits of using a PAM solution to prevent them to turn into a catastrophe.

1. SOLVING
The Privileged Access Conundrum

2. IT managers everywhere feel overwhelmed with the rising
tide of IT security threats they have to deal with in the face of
an increasing regulatory burden and the ever expanding
vision of the IT infrastructure. It is not surprising then that they
tend to overlook one particular area of IT security, which is the
privileged access that they grant to themselves and/or their
colleagues in order to do their jobs. Not only are the
challenges of privileged access moving up and down the
stack from the hardware layer up to the business application
level, they are also moving outside those boundaries to the
cloud and virtual computing environments. Regardless of the
environment, there are administrators responsible for
managing those environments and privileged users with
access to highly sensitive information that must be managed,
monitored and controlled.
The British hacker Gary McKinnon, who the US government
wanted to extradite after he hacked Pentagon IT systems,
gained much of his access through privileged user accounts
which had been left with the default settings.

3. Privileged
Access Challenges
Today, organizations spend a lot of resources building an infrastructure
for securing the enterprise and assuring their business continuity and
compliance. Every typical IT environment comprises of hundreds or
thousands of servers, databases, network devices and more, all
controlled and managed by a variety of privileged and shared
identities – also known as break-glass, emergency or fire IDs – which
are the most powerful in any organization. This includes the ‘Root’
account on UNIX/Linux, ‘Administrator’ in Windows, Cisco ‘enable’,
Oracle ‘system/sys’, MSSQL ‘sa’ and many more.
What is a Privileged
User/Access
Someone with IT permissions to
These identities are often neglected; it is difficult to monitor their session
activities, and passwords are rarely changed. In some cases, these
identities are required not only by the internal IT personnel, but also by
external third-party vendors and, thus, require extra care, such as
secure remote access and secure session initiation without exposing the
credentials. Powerful passwords are also often found hard-coded
inside applications, scripts and parameter files, leaving them
unsecured and rarely changed. Mismanagement of privileged access
imposes great risks to organizations. These include the following:
Insider Threat – One of the biggest concerns today is the risk of insider
threat. In many organizations, the same Root or Administrator
password is used across the organization, making it easier for a
disgruntled insider to abruptly take down core systems.
?
Access highly sensitive data
Change critical IT systems
Conduct high value transactions
Cover their tracks in the audit trail
Administrative Overhead – With hundreds of network devices,
privileged access can be extremely time-consuming to manually control
and report on, and more prone to human errors. Moreover,
inaccessibility of such a password by an on-call administrator may
cause hours of delay in recovering from system failure.
Despite often being employees of a relatively low rank, the level of
access to sensitive data given to Privileged users is often the highest any
employees have had in the history of business. Worst still, poor practice
can leave Privileged user accounts easily accessible to outsiders. So, the
Privileged access issue is first about managing the Privileged user
accounts and then about managing the actual Privileged users, andin
many cases they are not well aligned.
Why Privileged Access can turn
Catastrophic
There are a number of reasons a once seemingly trustworthy Privileged
user might go rogue; one of the most obvious reasons being for
financial gains.
This can either be straight forward theft, such as the 2007 case of a “low
Audit and Accountability – Compliance regulations (such as Sarbanes- level” database administrator at the US banking services company
Oxley, PCI and Basel II) require organizations to provide accountability Fidelity National Information Services who was found to have stolen 2.3
about who accessed shared accounts, what was done, and whether million credit card records and selling them on to a data broker.
passwords are protected and updated according to policy.
Another reason is plain spite; a disenchanted privileged user may
Loss of Sensitive Information – Privileged accounts usually have choose to wreak havoc, just because they can. A former systems
unlimited access to backend systems. Compromising such accounts administrator of the Swiss bank UBS, RogerDuronio, was convicted in
may lead to uncontrolled access, bypassing the normal system 2006 of sabotaging his employers IT systems in retaliation over a
operation. For instance, this can result in manipulating billing records compensation dispute. UBS never reported the cost of lost business, but
and loss of money. did say the attack cost the company more than $3.1 million to get the
system back up and running.

4. The theft of intellectual property by employees leaving one employer PAMS is not just about protecting the data and intellectual property
for another is also adanger. There are many examples of “normal” assets of the business and paying regards to the privacy of employees in
users doing this, but privileged users have even greater opportunity general; it is also about complying with the requirements of regulators
with their wide-ranging access rights. that are often explicit about privileged users in their requirements.
Solution: HCL Privileged Access
Management Services (PAMS) PAMS Benefits
To bring all this under control requires that Privileged Users are given There are many benefits not afforded by other
unique access; their individual accounts must be the only way of
gaining access to IT systems at the Privileged User level and their
approaches:
individual activity, whilst operating at that level, should be monitored
and audited.
Privileged user accounts can be scanned for and
The access granted also needs to be modular; too often Privileged monitored to ensure default settings are never left
Accounts are assigned broad access rights that are far more than is in place.
necessary for a given individual to do their job. It is much safer to
assign fine-grained access controls at the account level. Such Privileges can be assigned to named users at the
“appropriate role separation” ensures privileged users cannot over
step the mark, accidentally or intentionally, and, should their accounts
account level on a case-by-case basis, with the
be compromised, the unauthorized user is similarly restricted. This is appropriate granularity of access, enabling the
known as the “least privilege principle”. “least privilege principle”.
The activity of privileged users can be
continuously monitored and the activities
recorded; the system will record who requested
for a password, when, and what actions they
took.
Compliance with standards and regulations can
be audited and proven when necessary.
In the event of a privileged user accountbeing
compromised, auditors will be able research the
incident forensically.
This has become especially true with the increasing use of For particularly sensitive systems, it ispossible to
virtualization. In the past, granting a given privileged user access to a
single physical server still gave them fairly limited access rights but, if
assign one-time passwords.
virtualized, there may be many different systems running on the same
server to which access is possible, if unlimited rights have been Dual control (maker and checker) can be enabled
granted at the physical level. when required.
A further benefit of this level of control over the assignment of
privileges in virtualized environments is that it allows competing Around the clock support for mission-
organizations to share the same physical resources. This is criticalsystems by geographically distributed
increasingly likely with the move to “cloud computing”. For the team scan be easily and safely enabled.
outsourcers like HCL that provide these managed services, the
granular granting of privileges and the auditing system management
activity is essential.
The granular granting of privileges can be
extended to the management of virtualized
environments.
PUM tools ease the integration of IT systemswhen
organizations come together followinga merger
or acquisition.