- In this lesson, 19.6,
we're going to focus in on privilege access management.
Now, a privileged account, we're defining as any account
that provides rights and permissions
above and beyond those of a non-privileged
or what we refer to often as a standard account.
Standing privilege is accounts that have
persistent privilege access,
24 hours a day, seven days a week, 365 days a year.
So, accounts like are admins or domain admins
or enterprise admins or super users or root.
Those are all privileged accounts, right?
They have rights and permissions
way above those of a non-privileged or standard account,
and they have them whenever they log in, right?
24 hours a day, seven days a week, 365 days a year.
We worry a lot about privileged accounts
because they are incredibly rich targets for cyber attacks.
As we know, right? An exploit is going to execute
in the context of the locally logged in user.
So if I'm logged in with, you know, extraordinary privileges
because I'm an admin, or you know,
we've just effectively given the keys to the kingdom
to our adversaries.
Zero-standing privilege
aims to minimize the standing privileges
granted to users or accounts within a system.
I would maybe take it a step further and say
zero-standing privilege wants to abolish
standing privileges granted to users or accounts
within a system.
Now, in practice, ZSP, zero-standing privilege,
means continuous reauthentication or explicit validation,
and granting to authorize users
the privilege access they only need for the minimum time
and only minimum rights they need
to complete whatever the task is,
which really goes back to our principle of least privilege.
And way back at the beginning of this course
we talked about a zero trust environment.
Well, this is a way that we implement
a zero trust environment in terms of the privileges
that we are going to be assigning.
So, let me give you some privileged account examples.
Administrator, root, super user,
or someone using the the sudo command, a service account,
or even embedded application accounts, right?
Administrative accounts generally
have the highest level of access and control
over an operating system, or a device, or an application,
a database, a domain, or even over our entire network.
The route or super user accounts,
again have complete control as well,
but these would be over a Unix or a Linux system.
Now sudo, S-U-D-O, is the Linux command to run programs
with the security privileges of another user,
and by default, when you run that command,
you're actually running as the super user.
Now, we don't generally think about
service accounts being a privileged account,
but they could be
because they often have elevated privileges
to access required system resources or network services.
And the embedded in applications,
there are embedded application accounts
that are hardcoded credentials embedded in the software.
Now, they should just be used for development purposes,
but sometimes they still exist.
Now, there are a number of regulations
and contractual obligations,
including HIPAA, PCI DSS,
the payment card industry data security standard,
GLBA, that's Gramm-Leach-Bliley Act, and GDPR
that expect organizations
to manage and to monitor privileged accounts.
Now, expectations include having a formal approval process
for new privilege account creation,
limiting privilege account use,
monitoring and tracing all privilege activity,
and then auditing privilege account assignments
and memberships.
So, privilege account management or PAM
is a really interesting and emerging
set of practices and technologies and policies
designed to manage and secure privilege accounts
and access to critical systems and to sensitive data
within our organization.
Now, the goal of PAM is to minimize the risks
associated with privileged accounts and standing access.
Now, PAM can be applied on premises and in the cloud,
and PAM solutions really assist
in meeting regulatory and compliance requirements
by providing detailed audit logs, reports, and visibility
into privileged account activities.
So, let's look at some PAM solution elements.
We have privileged account discovery,
privileged account credentials,
just-in-time privilege access,
and privileged elevation and delegation.
Now, privileged account discovery is used to identify
and to catalog all privileged accounts
within the organization, that's really our starting point.
What are all of our privileged accounts?
Then privileged account credentials,
enforce a strict controls
over privileged account credentials.
So for example, they have to be, you know, encrypted
or if we're using passwords,
they have to have secure storage in a vault
or they have to rotate them or they have to be multifactor.
Whatever it is, it's really putting the rules, right?
The strict controls
over those privileged account credentials.
Then we have JIT or just-in-time privilege access.
Now this privilege access is provided
only for a limited duration
so a limited time and specific tasks.
And then privilege elevation and delegation are mechanisms
for granting temporary or restricted privileges
to non-privileged users when needed.
Really reducing the dependency
on having those persistent privileged accounts.
So, account discovery,
having strict controls over the account credentials,
implementing just-in-time privilege access
which means you're only going to get access when you need it
for a limited amount of time
and only the rights and permissions you need,
and then having this ability
to delegate this privilege escalation again
for just specific tasks
so that we don't have to give someone
administrative privileges, if they really don't need it.
Now, PAM solutions enable organizations
to monitor and control privilege user sessions in real time,
and that includes capturing and recording activities
performed during privileged sessions, enabling auditing,
and if needed, forensic access.
So that brings us to a three second challenge,
but before we go there,
I just want you to think about
how we're handling privileged access
in most of our organizations right now.
In most of our organizations, we say to our administrators,
hey, you should have two accounts,
your administrator account and your regular user account.
And when you're doing normal stuff,
like your email or you know, going out to the web,
make sure you're logged in as your user account,
and when you're doing admin stuff, use your admin account.
But the reality is, that doesn't work
and it's never really worked.
And it's why we really need
to look at new ways of doing things.
And privileged account management,
I'm pretty convinced is the way of the future.
So, let's do our three second challenge,
five challenge questions, three seconds each.
Number one, any account that provides rights and permissions
above and beyond those of a standard account.
1, 2, 3.
And that's a privileged account.
Number two, a set of practices technologies and policies
designed to manage and secure privileged accounts.
1, 2, 3.
That's going to be PAM or privilege access management.
Number three, methodology to provide privilege access
only for a limited duration and specific tasks.
1, 2, 3.
Just-in-time privilege access.
Number four, the Linux command to run programs
with the security privileges of another user,
by default, that's the super user.
1, 2, 3.
And that's going to be the sudo or sudo command
pronounced differently
maybe in different parts of the world, S-U-D-O.
And number five, hardcoded credentials
used for software development purposes,
but not always removed.
1, 2, 3.
That's going to be embedded application accounts.
Let's do a security and action,
so we can apply our knowledge.
This one's about administrative access
and standing privilege.
You are concerned about administrative access
and the issue of standing privilege.
Now, you're planning on introducing the concept
of zero-standing privilege, so no standing privilege,
and privilege access management or PAM
with the goal of significantly reducing the attack surface.
But your organization is pretty resistant
to new methodologies.
How do you impress upon your audience
the importance of reducing standing privilege?
Think about how you might do that,
go ahead and put me on pause and jot down some notes.
Well, let's do the math.
Let's say in an organization, we have three domain admins
managing 10 domain controllers,
that's 30 instances of standing privilege.
Let's say we have one server admin group
that has five users in it,
and they're supporting a hundred servers,
that's 500 instances of standing privilege.
Let's say we have one help desk group
that has five users in it, and they support 500 users,
that's potentially 2,500 instances of standing privilege.
So when we do the math, we can say, oh my god,
there is just so much standing privilege going on,
you know, over and over again,
and 24 hours a day seven days a week, 365 days a year,
and maybe doing the math will impress upon someone
that this is really a significant exposure
and we need to do everything we can
to reduce standing privilege
and certainly zero-standing privilege,
zero trust,
the requirement to reauthenticate every single time.
And privilege access management,
you know, definitely, you know, addresses this issue.
And certainly, I think the wave of the future.
Explaining that, convincing people,
security and action, right?
There's your word cloud, you know what to do,
and when you're ready, we've got a quiz coming up,
I'll see you there.