Six Steps to Secure Access for Privileged Insiders and Vendors Sam Elliott | Bomgar

Agenda Current threat landscape Challenges with traditional Privileged Access Management Balancing security and productivity to drive business value 6 Steps to Secure Access Q&A

About the Speaker SAM ELLIOTT Director of Security Product Management, Bomgar Sam Elliott is responsible for the product management group that is driving product strategy for Bomgar's security products. He has more than a decade of information security, ITSM, and IT operations management experience. He also is a seasoned expert in the areas of cyber-security, data center discovery, systems configuration management, and ITSM. He resides in Atlanta, GA, with his family and can be found on twitter @samelliott.

Threat Landscape A breach is a matter of if, not when High trust still placed in people

Privileged Access Privileged Access Management traditionally focused on just the credential or account. That’s only half the battle against attackers. Expand focus to not only include privileged credentials, but also remote access mechanisms used by both employees and vendors.

What is #1 Method of Compromise?

Remote Access is #1 Method of Compromise Extremely easy for threat actors to find unsecured remote access pathways. Most security organizations don’t have visibility into all of the remote access pathways into their networks. Different teams & external vendors using their preferred tools. No centralized monitoring or auditing. 2017 Global Security Report

81% of Hacking-related Breaches Leveraged Stolen and/or Weak Passwords Privileged credentials are highly targeted “keys to the kingdom”. Admin passwords are often shared across teams. Many organizations forget about privileged credentials used by service desks, service accounts, app to app, third-parties, etc. 2017 Data Breach Investigations Report

Security Solutions Often “Inhibit Productivity”…

The Birth of a New Security Hole “Due to timing of the <Insert Important Event> let’s get this up and running and we will circle back about patching and hardening methods..” Boss Guy “If security slows down production which in turn reduces profitability, [executive management is] never going to side with IT. It's a matter of risk balancing, and if they've never experienced a security breach, they're going to take the risky route until they do.” Reddit Commenter

Make Least Privilege Productive

+ 6 Steps to Secure Access Secure the CONNECTION Defend the CREDENTIAL 1 2 Secure vendor access Secure insider access 3 Remove risk of shared passwords 4 Rotate & randomize privileged credentials 5 Secure Service Accounts 6 Remove threat target with app to app security

Accounts Access

Secure Vendor Access External vendors are “low hanging fruit” because they have to adhere to your policies. Number of third-parties connecting to company networks is rapidly increasing. Eliminate VPNs for vendors to improve security and access management.

Secure Insider Access Any employee who has privileged access: IT Admins IT Operations Operational Technologists Service Desks Only 41% of security professionals trust employees with privilege access completely 2017 Secure Access Threat Report

Remove Risk of Shared Passwords Use a password vault or safe so users don’t see actual credentials. Increase productivity by eliminating check- in/check-out and directly inject credentials into a remote session. Eliminating their visibility to the credential reduces threat of being phished or used through another pathway.

Rotate & Randomize Privileged Credentials Ensure every local credential that has some type of admin right has a unique credential. Stop lateral movement by eliminating common credentials across endpoints. If credential is compromised, won’t be useful for long because it’s rotated.

Secure Service Accounts Manage business uptime, but ensure those credentials can still be rotated. Critical business systems often have the same service account for years. Ensure critical systems stay productive while securing them.

Remote Threat Target with App to App Security Malicious users can compromise hard coded credentials in a script or an application. Remove a prime target with app to app credential security. Obscure credential through a Vault and rotate to remove threat.

+ 6 Steps to Secure Access Secure the CONNECTION Defend the CREDENTIAL 1 2 Secure vendor access Secure insider access 3 Remove risk of shared passwords 4 Rotate & randomize privileged credentials 5 Secure Service Accounts 6 Remove threat target with app to app security

Summary Securing privileged credentials is a must, but don’t just fight half the battle. Discover and take control of all of the remote access pathways being used by both insiders and vendors. Follow the 6 Steps to Remote Access – in the order that makes sense for your organization. Don’t be an assumption cabbie

Summary

Questions?

Thank you for attending!