The number of cyber attacks against organisations is increasing year on year. The method and target of attack is also changing, from data theft over time to the current biggest threat of ransomware attacks. This is an attack conducted with the aim of encrypting data and blackmailing system owners for a significant amount of money to recover it. Everyone seems to be addressing the topic of “Cyber Security”, but do you know exactly where your employees have access to and what other types of accounts your organization uses and who owns them? If not, how are you going to effectively prevent an attack?
But how is it possible that the attacks are so successful? Consider the recent attacks on Czech hospitals that disabled key IT systems and left entire departments unable to work, with patients being transferred to other hospitals. In this article we will not deal with protection from attack as such, but look deeper down to the principles of account management itself. After all, in order for a malicious actor to do damage, they need to exploit some vulnerabilities, and one of them is uncontrolled access management to IT systems!
Hand on heart, how many of us have a perfect overview of who has access to what in our company? How many remote accesses (VPN, RDP, ssh, etc…) do we actually have issued in the company for employees and how many external vendors actually use remote desktop? How often are permissions granted recertified and who granted them and for how long? Isn’t IT itself managing this by some inertia of established processes? This is cyber security too!
Let’s imagine that we really are under attack. An attacker has compromised one of our administrator’s accounts. Where can he go now? Can we cut him off without stopping the business and causing operational losses? At times like this, it can be minutes that can save millions in the long run.
Identity management software (IdM), such as the Czech IdStory tool, can help you keep your system access in order.
How will IdM help to straighten out the accounts?
Identity manager has a few basic principles to keep your accounts in perfect shape.
- Central management and visibility of all accounts in the organization
- Clear accountability for access assignment
- Auditability of all managed accounts
- Automation – creating and deleting accesses based on clearly defined rules
Read more in the article What is Identity Management.
What bills are often forgotten?
If we’re talking about access management, then employee accounts come to mind. Yes, having an overview of employee accounts is essential for good identity management. However, in addition to the common accounts, we also have some that are often forgotten, yet interesting. Often far more interesting to attackers than a regular employee’s account.
Freelance accounts
It’s not just employees who do work within corporate IT systems. A very large group of users are freelancers, including
- external suppliers – rarely centrally recorded
- trainees – sometimes they are registered in the HR system
- contractors – often not registered in the HR system
- partner company accounts – similar to external contractors
- and others
Not only are freelancers rarely recorded in one place, they are mostly forgotten about in terms of terminating them on time and reviewing their access. The remote accesses they often use are issued for long periods of time, sometimes indefinitely. One of the worst practices in managing outsourced accounts is issuing shared access accounts – for example, one account for an entire partner firm. If there are any problems, it is then not at all clear who did the intervention and when.
Remote accesses
Remote access is a special type of account that is used by both internal employees and outsiders. Recording remote access and managing it carefully should be one of the foundations of identity management. The stations from which the internal network is accessed remotely are rarely managed by the company, so it is necessary to be suspicious of them at best and to be able to block them quickly in case of compromise.
Privileged accounts
Here we can count accounts with higher privileges than ordinary users. Often these are accounts that run some IT services in the organisation or accounts for the administration of a system.
The administration of special accounts can be basically secured by identity management – it keeps track of who created the account and when, what groups it has in the AD domain, for example, and who is the owner (natural person) of the account. If that owner leaves, IdM prompts authorized individuals to set up new owners so that special accounts are not left off the books in the organization. Privileged accounts
For real-time access control to privileged accounts, such as the ability to temporarily work under the account, then a specialized PAM (privileged access management) software addresses this.
Temporary and test accounts
A well-known bon mot says that “the basic unit of temporariness is 1 furt”. And unfortunately, this is often true of accounts that someone created for some short-term use or just needed to test something quickly and forgot to clean up after themselves. This “garbage” not only makes the management of accounts unclear, but often the owner and purpose of the account is not even known. When compromised, it is not easy to determine the extent of the damage done.
Summary
In this article, we have shown through examples what types of accounts are found in organizations and why it is a good idea to address them with respect to the topic of cybersecurity. Not managing access not only makes IT staff’s job more difficult, but it can pose quite a significant security threat.
