You probably recognize this: a new employee joins the company and all sorts of things need to be arranged for them. If Identity & Access Management is in order within your organization, creating the basic account and assigning permissions will be perfectly arranged. If not, give us a call and we’ll be happy to help!
For all non-standard tasks, we have to rely on our IT admins. After all, they can manage (almost) everything on our IT infrastructure because they’re supermen! In practice, these admins often have a separate admin account with which they can manage the requested tasks. It’s likely that these accounts have accumulated a lot of privileges over time, from managing mailboxes to accessing file and database servers, often containing sensitive data.
And here’s the no-brainer: hackers are targeting these admin accounts!
They attempt to access these accounts through various channels. It often starts with social engineering. On public websites where our professionals share their profiles and positions within the organization with the rest of the world, social engineers possess valuable information. This allows them to ultimately pose as someone from your organization and insert a backdoor into the IT infrastructure. “Install this update to make the system more secure,” the message reads, and the backdoor is installed! Time to deploy the hacking team to expand it further until they’ve obtained the correct admin accounts and rights, with all the ensuing consequences.
WHAT CAN WE DO ABOUT THIS?
Implementing Privileged Access Management. This removes the rights of admin accounts and grants them temporary privileges when approved.
We can help you implement Privileged Access Management in various areas:
- Determining Special Privileges and How to Recognize Them
- Mapping the adjustments required to set up Privileged Access Management
- Setting up and maintaining Privileged Access Management
What results can I expect after implementing Privileged Access Management?
- Prevent hackers from obtaining admin accounts with special permissions
- Be in control of the process of creating and granting special powers
- Monitoring the special powers to detect abuse
- Providing a platform and processes for managing accounts with special permissions
Our IT admins remain supermen, but they only turn into supermen when we ask and approve.
Want to learn more about Privileged Access Management? On July 12th, CTO James Cowling of our partner OCG will host a webinar. Click here to register!
Author: William Tja, Senior Consultant