MIM/PAM Case Study Dean Guenther IAM Manager Washington State University May 2016 Copyright 2016, Washington State University

Spokesman Review August 22, 2015 WSU administrators announced this week they are trying to thwart a sophisticated hacking attempt that was detected more than a month ago … with help from federal investigators and private cyber security firm[s]. Copyright 2016, Washington State University

Spokesman Review The university said it has found no evidence the hackers have accessed sensitive or research data. Copyright 2016, Washington State University

Spokesman Review The university said it has found no evidence the hackers have accessed sensitive or research data. … the university will employ new software and eliminate compromised communication channels … Copyright 2016, Washington State University

The Problem We needed a better mechanism to prevent system administrators from falling victim to privilege escalation. Copyright 2016, Washington State University

The PAM Model Many recent well-publicised hacking attacks have targeted system administrators, with hackers gaining access to administrative credentials, with which they have created further accounts with extensive permissions. – James Cowling Copyright 2016, Washington State University

The PAM Model Privileged Access Management (PAM) helps mitigate unauthorized privilege escalation attacks. Copyright 2016, Washington State University

The PAM Model Privileged Access Management (PAM) helps mitigate unauthorized privilege escalation attacks. PAM utilizes MIM's request and approval workflow Copyright 2016, Washington State University

The PAM Model Privileged Access Management (PAM) helps mitigate unauthorized privilege escalation attacks. PAM utilizes MIM's request and approval workflow Uses AD’s SID History. Copyright 2016, Washington State University

The PAM Model Privileged Access Management (PAM) helps mitigate unauthorized privilege escalation attacks. PAM utilizes MIM's request and approval workflow. Uses AD’s SID History. The end result is an end-user requesting and using elevation of privilege. Copyright 2016, Washington State University

SID History SID History is an Active Directory (AD) user account object Copyright 2016, Washington State University

SID History SID History is an Active Directory (AD) user account object Helps in migration scenarios. Copyright 2016, Washington State University

SID History SID History is an Active Directory (AD) user account object Helps in migration scenarios. New infrastructure accounts need to access the old infrastructure. Copyright 2016, Washington State University

SID History SID History is an Active Directory (AD) user account object. Helps in migration scenarios. New infrastructure accounts need to access the old infrastructure. SID history attribute is included in authorization tickets. Copyright 2016, Washington State University

SID History SID History is an Active Directory (AD) user account object. Helps in migration scenarios. New infrastructure accounts need to access the old infrastructure. SID history attribute is included in authorization tickets. PAM drops people in/out of groups using SID history. Copyright 2016, Washington State University

Copyright Microsoft

Support from the President … the university will employ new software … Copyright 2016, Washington State University

Support from the President … the university will employ new software … WSU would use the new MIM/PAM. Copyright 2016, Washington State University

Support from the President … the university will employ new software … WSU would use the new MIM/PAM. 1,500—2,000 servers 300 system administrators Copyright 2016, Washington State University

Modified PAM Model We did not follow the suggested Microsoft model for MIM/PAM. It did not scale well for us. Copyright 2016, Washington State University

Modified PAM Model We did not follow the suggested Microsoft model for MIM/PAM. It did not scale well for us. Using a trusted, private forest. Copyright 2016, Washington State University

Modified PAM Model We did not follow the suggested Microsoft model for MIM/PAM. It did not scale well for us. Using a trusted, private forest. RBAC model for roles and permissions. Copyright 2016, Washington State University

Full page photo sample 2 Copyright 2016, Washington State University

Modified PAM Model We did not follow the suggested Microsoft model for MIM/PAM. It did not scale well for us. Using a trusted, private forest. RBAC model for roles and permissions. We used MIM Synch. Copyright 2016, Washington State University

Modified PAM Model We did not follow the suggested Microsoft model for MIM/PAM. It did not scale well for us. Using a trusted, private forest. RBAC model for roles and permissions. We used MIM Synch. Typical MIM systems. Copyright 2016, Washington State University

Timeline MIM/PAM development began September Copyright 2016, Washington State University

Timeline MIM/PAM development began September About 3 people over 2 months. Copyright 2016, Washington State University

Timeline MIM/PAM development began September About 3 people over 2 months. Not including department work. Copyright 2016, Washington State University

Timeline MIM/PAM development began September About 3 people over 2 months. Not including department work. First production use in December. Copyright 2016, Washington State University

Timeline MIM/PAM development began September About 3 people over 2 months. Not including department work. First production use in December. It takes about 1-2 months per department/college to on board. Copyright 2016, Washington State University

Timeline MIM/PAM development began September About 3 people over 2 months. Not including department work. First production use in December. It takes about 1-2 months per department/college to on board. About 60% done. Copyright 2016, Washington State University

MIM PAM Issues PAM role expiration does not remove current session access. Copyright 2016, Washington State University

MIM PAM Issues PAM role expiration does not remove current session access. The patching of SQL hosts start dropping connections. Copyright 2016, Washington State University

MIM PAM Issues PAM role expiration does not remove current session access. The patching of SQL hosts start dropping connections. Bug in custom group synch. Copyright 2016, Washington State University

MIM PAM Issues PAM role expiration does not remove current session access. The patching of SQL hosts start dropping connections. Bug in custom group synch. ADMT runs as a domain admin. Copyright 2016, Washington State University

MIM PAM Issues PAM role expiration does not remove current session access. The patching of SQL hosts start dropping connections. Bug in custom group synch. ADMT runs as a domain admin. Role activated, but access not granted. Copyright 2016, Washington State University

MIM PAM Issues AD integrated tools do not always work in a different forest. Copyright 2016, Washington State University

MIM PAM Issues AD integrated tools do not always work in a different forest. Can’t use domain or enterprise admins groups. Copyright 2016, Washington State University

MIM PAM Issues AD integrated tools do not always work in a different forest. Can’t use domain or enterprise admins groups. Issues installing some applications. Copyright 2016, Washington State University

To Do list Finish RBAC for all campuses/colleges/departments. Copyright 2016, Washington State University

To Do list Finish RBAC for all campuses/colleges/departments. Examine other use cases for RBAC. Eg network services, VPNs, firewalls Copyright 2016, Washington State University

To Do list Finish RBAC for all campuses/colleges/departments. Examine other use cases for RBAC. Eg network services, VPNs, firewalls Help Desk training. Copyright 2016, Washington State University

To Do list Finish RBAC for all campuses/colleges/departments. Examine other use cases for RBAC. Eg network services, VPNs, firewalls Help Desk training. Automated workflow for role and permission creations. Copyright 2016, Washington State University

To Do list Finish RBAC for all campuses/colleges/departments. Examine other use cases for RBAC. Eg network services, VPNs, firewalls Help Desk training. Automated workflow for role and permission creations. Automated user creation. Copyright 2016, Washington State University

To Do list Finish RBAC for all campuses/colleges/departments. Examine other use cases for RBAC. Eg network services, VPNs, firewalls Help Desk training. Automated workflow for role and permission creations. Automated user creation. Implement Multifactor Authentication. Copyright 2016, Washington State University

To Do list Automate role candidate creation for users. Copyright 2016, Washington State University

To Do list Automate role candidate creation for users. Separate MIM Portal from PAM Portal. Copyright 2016, Washington State University

To Do list Automate role candidate creation for users. Separate MIM Portal from PAM Portal. Separate MIM Synch from MIM Service. Copyright 2016, Washington State University

To Do list Automate role candidate creation for users. Separate MIM Portal from PAM Portal. Separate MIM Synch from MIM Service. Rethink the whole process through again post AD DS 2016 migration. Copyright 2016, Washington State University

To Do list Automate role candidate creation for users. Separate MIM Portal from PAM Portal. Separate MIM Synch from MIM Service. Rethink the whole process through again post AD DS 2016 migration. Support additional PAM features available in AD DS Copyright 2016, Washington State University

To Do list Automate role candidate creation for users. Separate MIM Portal from PAM Portal. Separate MIM Synch from MIM Service. Rethink the whole process through again post AD DS 2016 migration. Support additional PAM features available in AD DS Move some support to IAM. Copyright 2016, Washington State University

To Do list Automate role candidate creation for users. Separate MIM Portal from PAM Portal. Separate MIM Synch from MIM Service. Rethink the whole process through again post AD DS 2016 migration. Support additional PAM features available in AD DS Move some support to IAM. Complete the documentation. Copyright 2016, Washington State University

To Do list MIM/portal approval workflow for “one time” elevated permission. Copyright 2016, Washington State University

To Do list MIM/portal approval workflow for “one time” elevated permission. Better monitoring for Data Center Operations. Copyright 2016, Washington State University

Final Thoughts The whole process is only as good as the strength, adoption, and enforcement of your RBAC model. Copyright 2016, Washington State University

Final Thoughts The whole process is only as good as the strength, adoption, and enforcement of your RBAC model. Get support from the highest leadership level possible. Copyright 2016, Washington State University

Final Thoughts The whole process is only as good as the strength, adoption, and enforcement of your RBAC model. Get support from the highest leadership level possible. It takes a lot of effort. Copyright 2016, Washington State University

Cast of Characters Tom Ambrosi, CISO Matt Kunkel, DCISO, PM Dan Hamilton, CDS Nathan Mertz, OCG Dean Guenther, IAM Copyright 2016, Washington State University