This blog was written by an independent guest blogger.
Privileged users are the key to the information system. The operation of information systems and the availability of enterprise resources depend on privileged users’ actions. If admins make a mistake or their credentials are leaked to attackers or competitors, it could put your business at serious risk.
When business processes depend not on one information system but on a set of complex solutions, controlled by several administrators with different powers and competencies - it becomes very difficult and costly to control their actions. This is especially true if the proper authentication system is not implemented and administrators use widespread or default passwords.
Of course, if all admins are crystal-clear and competent, then such a situation may still suit the top managers for some time, but if an incident occurs, it will not be easy to identify who is guilty.
If you hire a new administrator who does not understand all the interconnections of the system and destroys something by mistake, they may try to assure that others are to blame. Therefore, all privileged users must be authenticated separately and efficiently. Their actions should be controlled with the greatest possible granularity - down to specific commands, operations, and clicked buttons.
There are many different ways to hack the system. For example, crooks can take advantage of the lack of an update and patch management system exploiting zero-day vulnerabilities or turn to malicious insiders. However, for external attackers, the ability to spoof an administrator account is actually the best method to quickly and stealthy breach an information system. Therefore, the reliability of the authentication mechanism for administrators and other privileged users is the key to the security of the company.
Best practices for authenticating privileged users
First, you need to know the requirements for authenticating privileged users. There are plenty of infosec standards and regulations in this field. Most of them have the following criteria:
- One person - one account. This requirement is understandable and straightforward. If there is a shared or role-based account, and the password is known to several people, then it is hard to establish exactly who used it and performed specific actions. It is good if there are videos from office cameras, but, for example, the ability to connect remotely neutralizes this method of identification. One person can physically sit at the computer, and several other users can remotely connect to this account simultaneously. In this regard, the security system must know the person who is using the corresponding login name.
- Legal requirements. In some countries, a legally significant authentication procedure is required for privileged users where each recorded action must be signed with an electronic signature. If illegal acts were committed using the company's computer, then the manager must provide information about who exactly did it. Otherwise, they may be responsible for these actions.
- Timely removal. Security standards require control over user access to information. Control is not only granting permission to access resources but also the timely removal of access rights. This is not a trivial task, especially if there are many applications accessible from the external network. Typically, for timely removal of rights, a role model is used. In this case, a directory of users with all their roles and a Single sign-on system (SSO) allow you to remove user rights from all applications at once.
- Non-repudiation. Many standards require the ability to conduct an investigation. Non-repudiation is associated with legal matters. All actions of privileged users must be signed with an electronic signature generated using the private key. According to the rules, this can only be done by a specific user who has access to the private key. It is highly desirable that this key is stored on a removable storage medium strongly associated with the user, for example, on a plastic card.
- BYOD. In the era of digitalization, companies are forced to keep part of information systems constantly working. This implies that administrators have the ability to fix problems using any device at any time. Therefore, you have to allow remote administration, including the use of personal devices. This saves resources and money. However, when adopting BYOD, the authentication system should be based on standard technologies not tied to a specific device, platform, or program. To simplify BYOD, you need to use standard authentication protocols that are used by the most popular remote administration tools.
- Clouds. Not all systems are now located within the perimeter. In the case of corporate use of the cloud, authentication must be linked to corporate verification mechanisms. To do this, cloud service providers offer the use of federated authentication protocols, such as OpenID or SAML, and access cloud services using the same authenticators as when accessing a corporate system.
All of the above requirements should be carefully considered when building a corporate authentication system. Privileged users should be provided with enhanced authentication mechanisms. Although they are somewhat more expensive, security, in this case, is more important than the cost of an additional identifier.
To fully comply with all of these requirements, the best variant is to use an SSO platform, an enterprise IDM with a role-based access rights management model and support for federated authentication protocols, as well as special devices for reliable authentication of privileged users.
What to use instead of a password?
For privileged users, simple passwords cannot be used. It is easy to intercept passwords with the help of a Trojan program, even if you use secure protocols like a VPN. The low cost of this authentication method is offset by the elevated risk of compromise, which is unacceptable for privileged users. Therefore, the standards strongly recommend (and sometimes even imply fines) that at least IT and information security administrators avoid using simple passwords. The alternatives can be as follows:
- Graphical passwords. Recently, various graphical authentication methods have begun to be used. Graphical password schemes allow using specially formed pictures to authenticate users based on specific rules. This method is relatively cheap and does not require complex protocols. At the same time, it provides ways to protect against automated interception. However, recording the authentication session and knowing the rules allow an attacker to guess the password. In addition, it is difficult to make this method legally significant.
- One-time passwords. The cheapest alternative to a simple password is a One Time Password (OTP). You can get a code in different ways: SMS, using a special device, or a program. The principle of OTP generation can also be different: by number, by time, by crypto algorithm, or be even completely random.
- Biometric authentication. As an identifier, you can use biometric parameters of a person, such as fingerprints, retina, hand veins, face, etc. With the current proliferation of photographic lenses built into mobile phones, these technologies can achieve reasonably good results at an affordable cost. Fingerprint scanners are built into some smartphones, and face recognition is available in Windows. These technologies allow you to connect the device and the person who works with it.
- Behavior analysis. It is possible to assess whether the specific person is working at the computer by analyzing additional information about his actions. For example, the working style on the keyboard is unique for each person. In addition, it can vary depending on the device they use - the virtual keyboard, tablet keyboard, standard keyboard, etc. However, this method cannot be the main one for authentication. It can be used as an additional factor for the most important operations. When administering information systems, most user actions are routine operations, and therefore user behavior can be checked for "commonness."
- Additional devices. For authentication, you can use additional devices to generate one-time passwords, store secret keys, and even sign documents. In particular, now, a smartphone with a built-in TPM module for storing encryption keys may well act as such a device. In some cases, for mobile devices, you can use external modules for storing identification information, interacting with the device via Bluetooth.
It should be noted that the listed alternatives are not mutually exclusive. They are complementary. It is quite possible to imagine multi-level authentication where a graphical password is used to access a database of face recognition images stored in the protected memory of a device with one-time passwords. At the same time, the system can take into account the characteristic features of the set of commands sent by the administrator (behavior analysis) and timely suppress attacks from the outside. All authentication methods can be used in one system, which makes this procedure highly secure.
Identity management tools for administrators
For administrators, some tools automate authentication management for both regular and privileged users. These tools include:
- Password vault. This is usually a local application that encrypts all passwords for all user services. It can be accessed using a local password, and then this application automatically sends passwords to all services to which users connect. This eliminates the need to enter the password by hand and it will be difficult to intercept it using a keylogger or during an unsafe connection. Passwords stored in such an application will also be difficult to guess - they are generated randomly.
- SSO. In essence, this is a development of the idea of secure password storage, but in a network version. The storage is located at the entrance to the corporate network, and users, especially privileged ones, having passed the authentication procedure in it, get access to all other corporate resources. At the same time, users do not know passwords from all systems - they are hidden from them. Therefore, the privileged user cannot connect to a specific resource directly and bypass the SSO. In addition, enterprise SSO can also support federated authentication protocols for verifying the identity of users connecting to enterprise cloud services — sometimes referred to as Web SSO. SSO obtains information about which corporate resources should be accessible by users either from the user directory or a separate IDM system.
- IDM. It is highly advisable to use IDM solutions in a large information system for managing access rights. For privileged users, special roles are created that describe the minimum permissions they need. To provide access for a specific user to an administered resource, it is enough to bind the corresponding role to it. Moreover, modern IDMs allow you to issue temporary rights, provide access to resources using a schedule, quickly block access to users suspected of compromise, and much more.
- PUM - Privileged User Management. Some systems for controlling privileged users include built-in SSO mechanisms. In particular, they allow you to combine the requirements for authentication and requirements for authorization, enable the use of privileged accounts and correlate them with personal accounts. This makes PUM an essential element - privileged users cannot connect directly to the resources of the corporate network and their actions will be fully logged. Modern authentication protocols make it possible to connect PUM to external SSO and IDM systems, thereby integrating privileged users into a common access control system.
For large information systems with many administrators, outsourcers, department heads, and other privileged users, it is best to use all of these tools. Still, in specific cases, you can get by with a minimum of specialized solutions, for example, PUM with built-in SSO.
Managing privileged user passwords with PUM
The privileged user password management system allows you to separate administrators from the systems they control. The fact is that administrators can always create an additional administrative account in the system and use it to perform unauthorized actions. To exclude this possibility, it is necessary to ensure that administrators interact not directly with systems, but with an intermediary who already interacts with the target system and also records all the actions of administrators. Attempts to create additional privileged accounts will be recorded in the PUM and can be used during the investigation of incidents.
It is vital that the authorship of all recorded commands is accurately determined without the possibility of rejection. To do this, it is necessary to entrust PUM with the tasks of reliable authentication. Of course, PUM can be connected to an already deployed SSO system using federated or corporate authentication protocols; however, you need to have the corresponding system deployed to do this. It is always better for privileged users to use stronger authentication methods than for authorizing regular users. Thus, the presence of its own separate authentication system in PUM makes it more reliable and secure.
It is crucial for PUM to guarantee that users do not try to connect to target systems directly, bypassing control. And the authentication system provides just such a guarantee. Administrators simply do not know passwords from administrative accounts in target systems - this information is stored in PUM. As a result, PUM has the opportunity not only to record actions but also to block access for administrators if they try to perform dangerous actions. Thus, for PUM, having an embedded and integrated SSO system is an additional feature, convenience and, ultimately, a competitive advantage.
Conclusion
Today, correct authentication procedures and rules cannot be ignored. For privileged users, this is crucial. Fortunately, there are not many privileged users in most organizations. More complex and expensive authentication methods can be used for them, up to special devices with built-in cryptographic functions, complex authentication protocols, and abnormal behavior recognition. For companies that care about protecting against insider threats, there are all the necessary components to authenticate almost any number of privileged users. At the same time, it would be nice not only to authenticate privileged users but also to record actions. Hence, it is logical to implement not just an SSO system with support for strong authentication for administrators but a full-fledged PUM with integrated SSO.
