The Super Security Risk of Super-User Accounts
By: Orhan Yildirim
It is urgent for organizations to challenge the risks and rewards of super-user accounts.
In the physical world, the sharing of keys to houses, offices, cars, safe deposit boxes, and more causes anxiety and concern, even when those keys are shared with the most trusted colleagues.
In the digital world, allowing super-users to access mission-critical systems and valuable data should cause even more anxiety as the havoc they can create – intentionally or unintentionally – can be severe and happen so quickly the damage done could take months or years to repair and in some cases, there could be no recovery.
The emphasis on and investment in securing systems from external adversaries has proven effective in keeping intruders out, but over the past several years, internal threats are often the “hidden secret” of enterprises who have been damaged by their own employees, contractors, vendors, or service providers.
Anyone inside an organization with super-user privileges has the potential to take entire businesses and their customers down, either through carelessness, incompetence, or maliciousness.
A corporate IT system cannot be efficiently run without granting the appropriate people the privileges to make changes in networks, clouds, databases, and applications. There is an important place for super-users – the key is to minimize risk through software security solutions.
Without ensuring policies are applied to those who have access to confidential information, secrets, sensitive personal data, and more, organizations are breaching their regulatory requirements, which can cause a failing grade from auditors, and actions at the board level, depending on the organization and the industries they serve.
Modern governance techniques can enable IT and OT leaders to set up super-users by privilege, by scope, by time, by location, and other levers.
If there is no way to automatically secure passwords, serious security risks will plague the enterprise, especially if there is no way of monitoring who is using a shared account at a particular time, so there is no audit trail, no discrete user records as part of event logging, and therefore zero accountability.
Ironsphere provides privileged access security capabilities to prevent credential theft of super-user accounts, eliminating unsupervised user access to the technology infrastructure, including servers, VMs, databases, and network elements.
Today we released our new Solution Brief detailing the features and benefits of our approach.
Ironsphere helps organizations to centrally enforce access policies, such as who can access which servers/ systems and what they can do once connected, based on their role in the organization.
With flexible access request and approval flows, Ironsphere ensures privileges are used only for legitimate business purposes and provides audit trails, regulatory compliance reports, VCR-like replay of all sessions, and live session watching, based on a man-in-the-middle architecture.
When users access target hosts through Ironsphere, all sessions are supervised, and user activities are tracked/monitored using a man-in-the-middle architecture.
The challenge is how to manage user access if they attempt to access target hosts directly, bypassing Ironsphere.
Ironsphere offers multiple solutions to address this challenge:
- Ironsphere’s Dynamic Password Controller eliminates personal privileges on target hosts, securely stores shared/non-personal super-user accounts in its encrypted digital vault, and automatically changes them at regular intervals. Once a super-user account is vaulted and updated by Ironsphere, users will no longer have direct access to the new credentials, effectively making Ironsphere the single owner of that super-user account.
When privileged users need the credentials for legitimate business purposes, the only available access is through Ironsphere or by getting the password from Ironsphere for direct access. This prevents unsupervised direct user access to target hosts, allowing Ironsphere to centrally track/monitor the usage of privileged credentials, and enabling personal accountability based on which specific user accessed which credentials and for what purpose.
- By blocking direct access at the network level and configuring rules in network devices to only allow Ironsphere to access target hosts, the solution blocks all other sessions to prevent any unsupervised privileged access. Such rules can be configured as ACLs (Access Control Lists) on network elements or as Access Rules on firewalls.
- Ironsphere provides agent software for Windows and Linux servers to be run as policy enforcement points on target servers. While network elements (e.g., routers, switches) do not allow custom software applications to be installed, they do provide built-in TACACS or RADIUS access controller software agents, which can work through a centralized server.
The benefits of using Linux Servers are well known, and the advantages of leveraging a more open operating system and software that can be loaded onto any “bare metal” server have driven adoption of Linux-based solutions across large enterprises and organizations in every industry.
Server operating system, also called Server OS, is a software layer on top of which other software programs, or applications, can run on the server hardware. The Server OS traditionally facilitates Web server, mail server, file server, database server, application server, and print server.
Keeping Microsoft Servers Protected and Accessible Only to Privileged Users: A New Ironsphere Solution Brief
Today we introduced our latest solution brief, illustrating how Ironsphere ensures control and protection of Microsoft servers, with privileged access security capabilities based on a man-in-the-middle architecture to prevent credential theft of super-user accounts.