1 / 20

Privileged Account Management Jason Fehrenbach, Product Manager

Privileged Account Management Jason Fehrenbach, Product Manager. Customer Use Cases - Introduction. A US-based Natural Gas and Electric company serving multiple states Project Requirements Only grant access to shared administrative accounts with pre-approval based on established policy

gil
Télécharger la présentation

Privileged Account Management Jason Fehrenbach, Product Manager

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Privileged Account ManagementJason Fehrenbach, Product Manager

  2. Customer Use Cases - Introduction • A US-based Natural Gas and Electric company serving multiple states • Project Requirements • Only grant access to shared administrative accounts with pre-approval based on established policy • Need to provide ‘firecall’ functionality • Needed to delegate administrative access for Separation of Duty (SoD) • Required logging of Windows administrator activity • Needed to consolidate Unix identities into Active Directory to streamline provisioning, password management and privilege account management

  3. Customer Use Cases - Introduction • A global leader in payment processing • Project Requirements • Needed to centralize accounts and get control over passwords and user lifecycles • Needed to replace NIS and provide centralized authentication • Needed to restrict and audit what users could do but at the same time provide for users to carry on with their day-to-day jobs • Needed to provide controls around shared administrative passwords • Needed to rotate administrative account passwords regularly • Needed to correlate and audit administrative activity with the actual end user

  4. PAM Sub-Categories PLATFORMS PRIVILEGES Operating Systems • Use Case – Utility Company • Needed to consolidate Unix identities into Active Directory to streamline provisioning, password management and privilege account management • Use Case - Payment Processing • Needed to centralize accounts and get control over passwords and user lifecycles • Needed to replace NIS and provide centralized authentication AD Bridge Shared Passwords Privilege Sessions Delegation

  5. PAM Sub-Categories PLATFORMS PRIVILEGES Operating Systems • Use Case – Utility Company • Only grant access to shared administrative accounts with pre-approval based on established policy • Need to provide ‘firecall’ functionality • Use Case - Payment Processing • Needed to provide controls around shared administrative accounts • Needed to rotate administrative account passwords regularly AD Bridge Network Devices Shared Passwords Databases Privilege Sessions Applications Delegation

  6. PAM Sub-Categories PRIVILEGES AD Bridge Shared Passwords Privilege Sessions Delegation

  7. PAM Sub-Categories PRIVILEGES AD Bridge Shared Passwords Privilege Sessions Delegation

  8. PAM Sub-Categories PROTOCOLS PRIVILEGES RDP VNC • Use Case – Utility Company • Required logging of Windows administrator activity AD Bridge SSH TELNET Shared Passwords HTTP HTTPS Privilege Sessions 3270 4690 5250 Delegation

  9. PAM Sub-Categories PLATFORMS PRIVILEGES • Use Case – Utility Company • Needed to provide find-grained delegation of administrative (root) access for Separation of Duty (Sod) • Use Case - Payment Processing • Needed to restrict and audit what users could but at the same time provide for users to carry on with their day-to-day jobs • Needed to correlate and audit administrative activity with the actual end-user Operating Systems AD Bridge Shared Passwords Privilege Sessions Delegation

  10. Unix Delegation: Problem Statement PRIVILEGES • How do I allow users to perform elevated tasks on Unix without losing control of the root password? • Pair a password vault with a delegation solution • Common delegation solutions • Native OS solutions (RBAC implementations) • The open source Sudo project • The Commercial Unix Security space AD Bridge Shared Passwords Privilege Sessions Delegation

  11. What did we discover? Native OS options • Result? Companies would: • Purchase a PAM sol’n only for their highest risk machines • Hate having to re-train admins & help desk staff on a new syntax • “Bend” sudo in crazy ways Commercial 3rd party solutions ~3,000 customers PRIVILEGES AD Bridge sudo Linux: 7.5M servers Unix: 2.8M servers Mac: 2.0M servers Shared Passwords No focuson thissegment! Privilege Sessions Delegation

  12. Sudo v1.7 and earlier PRIVILEGES AD Bridge Shared Passwords Privilege Sessions Delegation

  13. Field Feedback: Common Pain and Trends PRIVILEGES • How do I easily provide access control reports? • How do I deal with sudoers? • How to manage it, distribute it, etc • How do I enable central keystroke logging? • How do I know what is going on across lots of systems? • How do I provide more fine-grain control in the policy? AD Bridge Shared Passwords Privilege Sessions Delegation

  14. Sudo v1.8 and the new plug-in API PRIVILEGES AD Bridge Shared Passwords Privilege Sessions Delegation

  15. Example architecture using plug-in API PRIVILEGES AD Bridge Shared Passwords Privilege Sessions Delegation

  16. Example pain points that the plug-in API can assist with PRIVILEGES • Sudo Reporting • Access Control Report • Event Activity • Commands run • Policy changes • Deployment • Preflight and sudo plug-in installation • Policy Management • Editor, Versioning, Rollback • Keystroke Logging • Search, Playback • Separation of Duty AD Bridge Shared Passwords Privilege Sessions Delegation

  17. SUDO v2.0: Design Phase PRIVILEGES • http://www.sudo.ws/sudo/sudo-rbac.html (April 12, 2012) • New security policy format • Designed for the needs of the enterprise • Include an API to support analysis and reporting tools • Support grouping of commands and options in logical units • Facility management of sudoers by multiple stake-holders • Time based policy rules • Data source plug-ins AD Bridge Shared Passwords Privilege Sessions Delegation

  18. SUDO v2.0: Design Phase PRIVILEGES AD Bridge Shared Passwords Privilege Sessions Delegation

  19. Complete Identity & Access Management Manage Access to Business Critical Information Understand &Control Administrator Activity Access Governance Privileged Account Management Privileged Account Management AccessGovernance Simplify Account Management Audit User Activity User Activity Monitoring Identity Administration

  20. Thank You

More Related