Your incident response team or a third party has just notified you of a data breach in your organization. What are the first few steps you must take to stop the breach in action and prevent the attackers’ lateral movement?
Do you/your admins or security teams have IMMEDIATE access to the critical servers to investigate, isolate infected computers, adjust access entitlements, and secure backup data and systems?
As a best practice, highly privileged administrative accounts and passwords are vaulted. Suppose incident response doesn’t get immediate access to vaulted admin credentials to log in quickly. Consider a scenario where the necessary credentials are already checked out of the vault by another user. You are blocked until the checkout window expires or have to wait for the user to check the password back-in manually. In that case, the risk is that the breach will be successful, and dependent on the time required to respond and contain, has the potential to spread to other networked resources.
Time is, therefore, of the essence, as we learned in the 2017 NotPetya malware attack, where it took only seven minutes for malware to infect the worldwide network of a global shipping giant. In a more recent malware attack, we learned that the BazaCall threat “could move quickly within the network, conduct extensive data exfiltration and credential theft, and distribute ransomware within 48 hours of the initial compromise.”
When critical account access is needed immediately, every second matters!
In the above scenario, knowing that you can force password check-in of an account not checked back in after use is a huge benefit to avoiding delays. In our recent 21.5 release, a new feature enables an administrator with appropriate rights to force password check-in to release an account checked out by another user. Mitigating potential delays in gaining system access within a very short time-to-action window of opportunity, this feature can make the difference between a successful breach or a thwarted attempt.
While the above capability helps react to a breach in progress, it is much better to have Privileged Access Management (PAM) controls in place to prevent data breaches and ransomware attacks. Here are some of our recommendations for securing privileged accounts:
- As a very first step, vault privileged passwords.
- Avoid standing privileges and enforce least privilege based on approved just-in-time access request workflows.
- Decrease the overall number of accounts and passwords to reduce the attack surface ultimately.
- Enforce multi-factor authentication (MFA) policy during login and privilege elevation.
- Finally, audit all privileged activity and monitor live sessions.
Reflecting on the NotPetya attack, the chief technology and information officer at global shipping giant, Maersk, said that if they had implemented Privileged Access Management in their cybersecurity strategy, the impact of the malware attack would have been significantly lower.
In today’s expanding threatscape, it is vital to have a robust privileged identity and access management solution to properly verify who has privileged access to sensitive enterprise resources. According to Gartner, a just-in-time (JIT) privileged access model suffers from 80% fewer privileged breaches. As you strengthen your company’s identity maturity, Delinea PAM solutions based on the Zero Trust principles can help you protect your critical software and platforms from unauthorized access and usage.
Start your least privilege journey here
