How To Guard Your Organisation Against Data Breaches With Privileged Access Management

Data breaches and leakages remains a key concern for organisations. Gartner predicts that by 2018, 25 per cent of organisations will be reviewing who gets access to its corporate data and IT assets internally to reduce data leakage incidents by 33 per cent. The analyst firm has laid out some best-practice approaches to help companies become part of that 25 per cent.

Golden key image from Shutterstock

“Only less than five percent of organisations were tracking and reviewing privileged activity in 2015,” Gartner research director Felix Gaehtgens said. “The remainder is, at best, controlling access and logging when, where and by whom privileged access takes place — but not what is actually done. Unless organisations track and review privileged activity, they risk being blindsided by insider threats, malicious users or errors that cause significant outages.”

With data breaches becoming more commonplace, companies are turning to privileged access management, a set of technologies and practices that organisations can use to control who has access to corporate data and systems. Gartner has listed a few best-practices for risk-aware privilege access management:

• Inventory all accounts with privileged access and assign ownership
  When you’re working in an environment that uses virtualisation on a large scale or a range of cloud services, it can become difficult to keep tabs on who has been given permission to particular systems. Keep track of all the accounts in your IT environment that have been gifted with permission levels above those of a standard user by frequently scanning your infrastructure to find new accounts with too many privileges.
• Shared-account passwords must not be shared
  Sharing passwords kills personal accountability. Don’t even do it with people who share the same level of access as you. This one is a no-brainer.
• Trim down the number of personal and shared privileged accounts
  By doing so, you are reducing the number entry points for potential attackers and exit points for data to leak out from.

  According to Gaehtgens:

  Migrating to shared privileged accounts is a recommended practice; however, this requires appropriate tools — managing the risks and control issues that arise from the use of such accounts is inefficient and complicated without a shared account password management tool.

  Organisations should also establish processes and controls for managing the use of shared accounts and their passwords.

• Give temporary passes to regular users with standard access
  There are times when an employee requires a one-time access to a particular corporate system but that doesn’t mean you should upgrade his level of access permanently. Instead, you can use privilege elevation to allow temporary give them a higher level of access.