How To Choose A PAM Solution

Identity-related breaches are one of the most prevalent forms of attack businesses are currently facing, and a lot of those attacks are targeting privileged accounts, which can be leveraged to access a company’s most sensitive data. 45% of data breaches involve hacking, and a quarter of all cybercrime victims in the US and UK are those in managerial positions or who own a business.

In today’s digital-first workplace, where networks are made up of on-prem and cloud-hosted applications, corporate and personal devices, and office-based and remote workers, it can be difficult to keep track of who’s accessing which data and what they’re doing with it. But it doesn’t have to be.

Privileged access management or “PAM” solutions enable business to take control of privileged access to critical corporate data, making it easier to keep that data out of the hands of cybercriminals.

But how does a PAM solution work, and how can you work out which solution is the best one for your business?

What Is Privileged Access Management?

Privileged access management can be a bit of a tricky concept, so let’s start at the very beginning—a very good place to start—and first look at what a privileged account is.

Most companies organize their business systems in tiers according to the severity of the consequences should that system be breached. The higher a system’s tier, the higher the consequences of a compromise. Privileged accounts are assigned higher levels of permissions that grant them administrative levels of access to business critical, i.e. high-tier, systems.

PAM solutions enable organizations to monitor privileged access to high-tier systems to ensure that these systems—and the data stored within them—remain secure. They offer a number of features that work together to provide this security—which we’ll look at in more detail a bit later on—but, essentially, they store the login credentials of privileged accounts in a secure, encrypted vault, reducing the risk of them being stolen in a credential theft attack. Users can only access these credentials after verifying their identities via multi-factor authentication (MFA), which prevents cybercriminals from gaining unauthorized access to the credential vault.

Implementing a PAM solution gives organizations clear visibility of who is using privileged accounts and what they’re doing once logged in to high-tier systems. This enables them to detect anomalous activity that could be malicious. It also makes it much easier for admins to generate reports into account usage for auditing and compliance purposes.

Why Do You Need A PAM Solution?

There are two key use cases for investing in a PAM solution. First and foremost is to prevent account takeover attacks caused by credential theft. Credential theft, as the name suggests, is when a bad actor steals a user’s login information to gain unauthorized access to that user’s account, often undetected by security teams. There are two main methods by which an attacker can steal someone’s credentials:

1. They send their target a spearphishing email, in which they pose as a trusted source, such as a colleague, and trick their target into sending them their credentials. For example: “Hi Kate, I’ve forgotten the password to the shared OneDrive, could you ping it over when you get the chance? Thanks!”
2. They program a computer to crack their target’s password, starting with the most commonly used passwords then working character by character through every possible combination until it finds the right one. This is known as a brute force attack.

Once an attacker has successfully stolen their target’s credentials, they can use them to log into their corporate accounts, performing what’s known as an “account takeover” attack. From here, they can access corporate data, install malware on the user’s device, or carry out further internal attacks to gain access to higher-level systems.

Privileged accounts are a prime target for account takeover attempts; in the last two years, over a third of identity-related breaches involved the compromise of privileged accounts.

PAM solutions mitigate the risk of account takeover by requesting that all users authenticate themselves in two or more ways before they’re granted privileged access. This means that, even if an attacker manages to steal a user’s password, they won’t be able to verify their identity to log in.

The second key use case for implementing a PAM solution is to achieve compliance. Many compliance standards, including HPAA, PCI DSS, FISMA and SOX, require that organizations apply least privileges access policies to high-tier systems to ensure the security of sensitive data such as payment information or personal health information.

But there are two sides to compliance: firstly, the act itself of being compliant. Secondly, being able to prove your compliance. PAM solutions not only enable organizations to enforce least privileges access policies, but also prove that they’re doing this by generating reports of user activity in relation to accessing sensitive data. Some solutions even provide recordings of privileged session activity, making it possible for security teams to create a comprehensive audit trail, stating with confidence exactly who is accessing which data, and what they’re using it for.

What Key Features Should You Look For In A PAM Solution?

Privileged access management tools play a crucial part in protecting your organization’s most sensitive data. To do this, they offer a range of features, which often vary from solution to solution to meet different business use cases.

However, there are some features that all PAM solutions should have. Here’s our list of the top feature to look for in a PAM solution:

“Just-In-Time” Or “Zero Standing Privilege” Access

Standing privileges, according to tech research firm Gartner, are privileges that are continuously assigned to an account, granting them uninterrupted access to high-tier systems or applications. An example of a standing privilege is the pre-configured “admin” user set up by default on most laptops and computers, or a privileged account whose credentials aren’t regularly rotated.

Because standing privileges aren’t rotated, they make it easier for a hacker to carry out repeat attacks undetected, using the same set of stolen credentials to access sensitive data multiple times.

To mitigate this, it’s important that you look for a PAM solution that offers “just-in-time” or “ZSP” (zero standing privilege) access. ZSP enforces the principle of least privilege—which many compliance standards require—meaning that users are only granted the minimum privileges they need to carry out their work, for the minimum time they need to do it. When the user has finished their task and signed out of the high-tier system, their increased privileges are revoked or reduced, and the PAM solution rotates the login credentials for that system. This not only prevents attackers from being able to access an account using stolen credentials,  but just as importantly, in the event that a hacker does manage to access an account, it prevents them from being able to sign in multiple times.

A Secure Credential Vault

Every PAM solution should store privileged credentials that enable access to high-tier systems in a secure, encrypted vault. This prevents users from knowing the passwords to critical systems, which eliminates the risk of a hacker getting hold of them in a phishing attack.

Multi-Factor Authentication

Multi-factor authentication, or MFA, is an electronic authentication method that requires users to verify their identities in two or more ways before they’re granted access to a system or application. This ensures that a hacker can’t access that system or application, even if they manage to steal or crack that user’s password, as they’d need to pass a second factor of authentication.

A strong PAM solution should include built-in MFA, or integrate seamlessly with your existing MFA tool, to ensure that users accessing high-tier accounts are legitimate, and that they’re accessing these accounts from trusted devices.

As well as implementing MFA for end users, the PAM solution should request that admins also verify their identities before logging in to manage the solution. This ensures that attackers can’t hack into admin accounts and grant increased privileges to other accounts they may have taken over.

Session Tracking

The best PAM solutions offer session tracking functionality, which monitors and records the activity of any privileged user once signed in to a high-tier system. Some solutions do this by providing a full audit trail using breadcrumbs. Others offer the capability to capture full live video recordings of each session, as well as the user’s keystrokes.

This enables security teams and admins to quickly detect anomalous activity in real-time and link it immediately with a specific user account for faster risk mitigation. It also allows them to quickly and comprehensively prove compliance with HIPAA, PCI DSS, ISO and SOC regulations, among others.

However, while incredibly useful, some users may find the use of this technology intrusive. It’s important that you decide exactly which level of session monitoring you need, and explain the benefits of it to your users: you’re not trying to catch them out if they make a mistake; you’re trying to actively prevent cyberattacks.

Real-Time Alerts

No matter which type of session monitoring you opt for, it’s important that your chosen PAM solution enables you to configure custom real-time alerts to warn you immediately of any anomalous account activity. This could be in terms of suspicious login behaviors, or actual privileged session activity.

You should be able to set notifications according to activity type and user groups or roles, in order to receive the most useful alerts for your security team to mitigate any risks.

Reporting And Auditing Tools

PAM solutions offer a central management console from which admins receive a detailed overview of privileged access across their organization. The features within this console will differ between solutions, but there’s one in particular that you should be on the lookout for: reporting.

An effective PAM solution will enable you to easily generate detailed reports detailing who has which levels of access to which systems, and when they’ve “checked out” a privileged password from the credential vault—session monitoring is one part of this. These reports will save you time and stress when it comes to auditing and proving compliance, but also enable you to provide your insurance company with a complete picture of your access environment should your company fall victim to an attack.

Summary

A robust PAM solution will help you keep on top of your compliance and auditing requirements, whilst preventing your organization’s most critical data from falling into the clutches of cybercriminals who want to hold it ransom or sell it on the dark web.

There are a number of different solutions on the market, each with its own set of features—including those we’ve discussed above—to address specific business needs. While this means that the perfect solution for your organization certainly exists, it also means it might be a challenge to find it. But worry not! We’ve put together a guide to the best privileged access management solutions, highlighting the key features of benefits of each solution, to help you get started. You can find our guide to the top PAM solutions via the link below:

• The Top 10 Privileged Access Management (PAM) Solutions