Who is an administrator? Every computer has an administrator by default – this administrator is the one who enjoys privileges as (s)he is the only person with the authority to perform certain tasks. Tasks such as installing a software, configuring the operating systems, establishing security policies, maintaining and managing user account passwords and all other management tasks associated with keeping a computer up and running can only be exercised by an administrator. This essentially makes the administrator a person with unequivocal power.  Just like we have heard in Spiderman - ‘With great power comes great responsibility’, even in a real-world professional setting, this adage is no alien. Administrators have unparalleled power and that means there is a great level of responsibility associated with them. However, imagine the plight if an administrator misuses his/her privileges to install a bogus software or modify the security policies or change permissions on the system.   Role of CISO in the administrator context Now, the role of a CISO entails managing the risks to the confidentiality, integrity and availability of the organization’s intellectual property and information technology assets.  Given the nature of an administrator’s function and the nature of cyber-attacks lurking around, the most important question for CISO’s now is if the administrators protecting these critical IT assets are trustworthy? The reason being that most of the attacks today are a cause of compromised administrator accounts. The most recent hack to have occurred is that of Equifax where personal identifiable information of over 145 million Americans was stolen as per reports. The main culprits for the hacks, however, have been identified as malicious insiders, accidental insiders and compromised accounts – as per reports. Linking this to the absolute authority and privileges that administrators enjoy, it is evident that hackers see the administrator accounts as the most effective way of hitting where it hurts.   Ways to eliminate administrator perceived security risks Needless to say you must stay two steps ahead of cyber-attackers. Have you done a thorough background check of your administrators? Most of you might already have. So what else can be done to mitigate such a situation in the future? This is where information security solutions like Privileged Access Management (PAM) play an important role. These solutions are designed to ensure that a cyber security solution sits above in control of the administrators and not the other way around. Administrator access is completely managed and monitored through Privileged Access Management solutions and more so, administrator rights can be granted on a ‘need-to-know, need-to-do basis’. If you already have a PAM solution, you are on the right path – ensure that the solution is being audited and tested for vulnerabilities. It is a best practice to do so and to perform a thorough testing of the solution once every quarter. If you haven’t installed a PAM solution, right now is the time for you to consider prioritizing your privileged access security goals. Regulations have become stringent around this as well and it is better to act now than be sorry tomorrow.   Sectona provides the solution that can help you secure administrator access Take a look at what a PAM solution is and what it is capable of doing here. Read our whitepaper on Simpler, Faster & Complete Password Management to know more about effective ways of protecting passwords and ensuring secure access mechanisms.

The most epic of historical battles have been won when the victor was able to anticipate his adversary’s strategy and stay two steps ahead. It is the same when it comes to privilege misuse. You should be not just two but four steps ahead and anticipate the vectors that hackers can employ to attack your system. And I say this because you must assume that the cyber-attacker is already two steps ahead of you. So you have to be four steps ahead by anticipating potential privilege abuse attacks and taking measures to protect against them. Think like a hacker to stop a hacker. Well, easier said than done – how can you do this? Let’s break it down. A solution to a problem is just the end objective – but it is the approach to finding that solution which sets you apart and lets you be well prepared for privilege misuse. First step is for you to identify and understand the problem on hand. While this sounds easy, more often than not, in the information security world, a problem remains unidentified for weeks. Once you know the problem on hand, next step is to dig deeper and get to the root of the problem. Why did the problem occur, what could have caused it. Albeit time consuming, it is a crucial step for effective troubleshooting. Now things become easy – you know the problem, you know the root of the problem so finding the right solution becomes a comparatively easier task. Applying that to information security – you should first understand your infrastructure and identify all the loopholes that can be exploited. Anticipate and predict how a privilege misuse can happen in your system. Understand as to what are the different modes and means through which cyber-attackers could breach through these vulnerabilities. Now think of the assets you need to protect and the ways to protect them. Remember, this is a careful process where you must understand the business and financial impact of devising mitigation strategies. Lastly, the most important step would be to align the Board with your plans and execute protection strategies at the earliest without further delay. Logic Analogy with your organization To put this in better perspective, let’s look at a specific risk example. You have understood your company mission, its business, its technology and its infrastructure and have defined its crucial information assets such as servers, databases, network devices and others. Now, you understand the vulnerabilities and loopholes associated with this infrastructure. For instance, for these assets, you have privileged users and administrators who act as super users and have significant privilege rights. Can they pose as a threat? Absolutely. If you know they are the most important personnel, don’t you think cyber-attackers (hackers) would be aware of the same? There are two possible scenarios now. One is that the privileged users might have an intent of abusing these privileges or alternatively, they are prone to genuine human error which an attacker could take advantage of and lead to a privilege misuse. Isn’t it obvious that the hackers will attempt to gain control of these privileged accounts to hack into your assets? As you see the hackers are already two steps ahead. This step essentially is the characterization of risk. So with that done, how do you analyze how the hackers are two steps ahead and be prepared to protect these assets? Protecting against privilege misuse First, make sure you conduct background checks to ensure these administrators and privileged personnel are trustworthy. This way you can partly ensure that a direct inside attack won’t take place. Secondly, identify and implement security solutions such as Privileged Access Management (PAM) in place that help you secure not just on the credentials of privileged accounts but also the access rights and privileges of these accounts. This is to ensure that neither do the external hackers do not get access to your administrator account credentials and privileges nor do the internal privileged users abuse their privilege rights. Thirdly, monitor the solution for its effectiveness and vulnerabilities, if any. Assess the agility and scalability of the solution to align with the changing dynamics of your infrastructure. Next step is to constantly stay updated on the new attack modes and ways, new trends in information security i.e. be aware and educate yourself persistently. If need be, do not hesitate to undergo a technology refresh and update your privileged access security with the latest technology. Lastly, repeat the above steps in a regular fashion – it is an ongoing process. Rest assured, you are two steps ahead in the game and are better equipped to protect your organization from privilege misuse. By following the above, are attackers going to shy away? – No, they are not. But you are better prepared and ahead of the curve with the right approach and process set in place to protect your assets from privilege misuse. How can Sectona help you protect against privilege misuse? We have a unique Privileged Access Management (PAM) solution that is capable of employing the detect and prevent strategy when it comes to privilege abuse with its unique technology and approach. Download and read our Spectra PAM Datasheet to know more about our approaches and value proposition.

I have been reading Ruchir Sharma’s The Rise and Fall of Nations recently where I came across two interestingly coined terms – ‘anchoring bias’ and ‘confirmation bias’. Anchoring bias is the tendency to believe good times will last forever. Confirmation bias is the tendency of collecting only the data that confirms one’s existing beliefs. The idea that the book tries to convey is from a global economy perspective where you should identify signs and be attentive to sniff the hidden and not-so-obvious signals. Why am I saying all this and what is the relevance to privileged access security you may think. Let me explain.   Anchoring Bias in the Privileged Access Security Context Often, it so happens that in an enterprise setting, as soon as one implements a security solution, there is a tendency to believe that ‘we have implemented a solid security solution, we are compliant with our regulatory requirements, blocked ways for cyberattacks to take place and good times await us going forward’ – this ever so slightly tends to the anchoring bias concept. An extension to this would be thinking ‘we have covered all possible areas of cyberattacks with robust solutions so our attack surface has been reduced’. However, the reality is so long as an enterprise has critical assets, there will be attackers scheming their attack vectors. Cybersecurity, in general, is never about happily ever after, it is a continuous process. It is a well-known fact that cyber invaders are always on the lookout for new vulnerabilities to exploit and it is up to the security team to ensure that they don’t give in to the anchoring bias but instead strive to keep finding vulnerabilities and ways to protect those loopholes. In a similar fashion, you have evaluated and implemented a privileged access security product for your infrastructure and critical assets. But does that end there? Are you monitoring and aware as to how the product has been implemented in line with your user requirements or future architectural requirements? Are you on top of all the capabilities of the product and which capability is of paramount priority for your user access? Are you assessing the adoption and usage of the product among all privileged users? Answers to these questions will guide you to an important decision for 2018 – the Re-evaluation of existing products.   Confirmation Bias in the Privileged Access Security Context Let’s evaluate confirmation bias now in this context. How to ensure you are finding the right vulnerabilities and not missing out on any critical weak points? Are you likely to be the victim of confirmation bias? You are a security expert. You have analyzed historical patterns, identified and zeroed in on the different types of attacks and why those attacks happen and have even to an extent predicted the kind of attacks that are plausible. Yet, there is a 0.1% chance that you may have given in to confirmation bias by only collecting data enough to analyze historical patterns and your predictions and beliefs of why past attacks happened and why some are predicted to happen. Based on this, you have identified key privileged accounts and have done the needful to protect their access. But have you rightly identified all the critical devices in your infrastructure (both on premise and cloud) stack? Have you accurately mapped all the different types of privileged accounts associated with these devices? You have considered all your internal privileged users. But what about external users such as third party vendors & remote users. It is the age of remote users, they are everywhere. Even internal users today can be considered remote users, courtesy trends such as BYOD & offshore outsourcing. It has therefore become imperative today to focus on securing remote privileged access. More often than not, for collaborative activities to be facilitated for remote users, additional privileged accounts are created – sometimes known, in most cases unknown and unaccounted for exposing security gaps for cyber attackers to leverage. This leaves you thinking that your privileged user security goal for 2018 should be a renewed collaboration based privileged access security.   Prioritize Privileged Access Security To play my part of creating more awareness, it is recommended that you prioritize securing Remote aspects of every privileged User– a gateway that can bestow supreme levels of authority and power to cyber attackers causing enterprises significant business and reputational losses. The goal is to understand the in and out of your infrastructure including critical devices and critical users and analyze all possible vulnerabilities and weak points. Dare to think of the worst and as the popular belief goes ‘hope for the best, prepare for the worst’.   How we can help? At Sectona, we have engineered an advanced Privileged Access Management (PAM) and have developed a unique cross-platform and collaborative PAM suite for enterprises and service providers of any size and scale. We are equipped to help you stay ahead of the curve from the PAM perspective with our renewed PAM approach. Check out our Spectra Privileged Access Management and SpectraMSP to learn more about our products.

Special moment for us as we announce the general availability of our first product & release of Spectra Advanced Privileged Access Management for both enterprises and managed service providers. We have spent the last 9 months interacting with companies understanding the shift they are experiencing with privilege access security. What we have learnt from this exercise is that addressing user expectation is key to a successful privilege security program. With the explosion of cloud services and Apps & APIs, organizations need to constantly add capabilities that help them monitor & manage privileged accounts. It wasn’t long ago when IT was managing a handful of devices inside a locked room behind a firewall. Users today have gotten more savvy and are expected to accomplish more tasks. If users aren’t delighted, they find workarounds that leave gaps an expose organizations to security risks. Privileged accounts are still one of the weakest links in most common insider and cyber-attacks. If only we could automate more tasks to reduce human errors, collaborate securely with teams and integrate evolving cloud based devices and services, we would achieve modern privileged password security. Herein comes the rise of Spectra's Theme – Privileged User Security with Collaboration Hyper-Collaboration is needed today To rewrite the code for secure collaboration for privileged users, it is highly important to tailor security code with general activities of the users. Spectra helps with secure collaborative access with deep session management capabilities to address the constant need for IT Teams to collaborate seamlessly with partners and consultants. More Devices mean More Security Imagine the scenario where you can automatically discover assets across cloud & virtualized environment + automatically assign policies for internal and external users + provision administrator accounts to allow secure and fast access for users - Yes this is possible and we call this Adaptive Access for Privileged Users. Allow Access from Any Device Administrators are looking for flexibility and security teams always need to balance security. Power Administrators are looking for modern and quick ways of accessing a device with tools they love. Remote users must have isolated access with limited privileges and support users should get easy & quick access. Spectra handles dynamic user needs with advanced cross-platform access capabilities for hybrid cloud environment. We are re-imagining how today's privileged users will interface with not just on-premise devices but also cloud based systems. We are a dedicated and committed team motivated to resolve these challenges.  I thereby encourage you to learn more about us and our product here at Sectona.com