PAM
PRIVILEGE ACCOUNT MANAGEMENT

PAM – Privilege Account Management

Recurring reports of breaches demonstrate persistent IT infrastructure vulnerabilities. Perimeter security alone is no longer sufficient to protect digital businesses’ highly dynamic, hyper-connected IT environments. New insider threats emphasise a need to protect identities.

Active Directory is a critical component in identity management for most organisations.

About 95 per cent of companies rely on AD as their primary authentication mechanism. This makes it an increasingly frequent target of cyber-attacks. The NTLM hash mechanism generated by AD is often a feature of Pass-the-Hash attacks.

IAM solutions alone are not enough in the identity management strategy but must be supported by valid PAM solutions.

Microsoft has suggested an Enhanced Security Administrative Environment (ESAE) strategy (Red Forest AD Architecture) to overcome the vulnerability generated by hashes. But another possibility to simplify and strengthen administrator hash security is to make them irrelevant with the simple password rotation mechanism offered by PAM solutions and One-Identity’s Safeguard. With its Password Vaulting module and check out mechanism, it is possible to cycle the password after each use, eliminating the risk of hash reuse. Safeguard provides further protection by controlling administrative sessions.

Given the continuous increase in data breaches and double extortion, PAM forms the foundation of any protection strategy. This is why it is growing more than 20 per cent annually – a figure set to continue for the foreseeable future.

What is privileged access management?

Privilege Account Management (PAM) is the Solutions and Processes that control, monitor, protect and verify corporate IT privileged identities and administrative users.

PAM applications use the “least privilege” principle, where each user is assigned the minimum authorisations and access required to perform their tasks to:

• Ensure cyber security by reducing the attack surface.
• Protect privileged access to critical data and resources.
• Mitigate the risks of internal malicious or external cyber-attacks that can cause highly damaging data breaches.

Why is privileged access management (PAM) critical for businesses and a priority for CIOs and CISOs?

The Human Factor is one of the weakest points in the information security chain: privileged access management ensures that users have only the level of access required to perform their duties and for the time needed to perform a specific task, and for the duration of a specific session.

One Identity offers a comprehensive set of privileged account management solutions to provide companies with the ability to implement a successful strategy based on their application and technology ecosystem.

One Identity’s Safeguard for Privileged Account Management

One Identity solution includes:

• Credential Vault technology: comprehensive feature set required to eliminate superuser password sharing.

• Session Audit: allow you to verify what someone (or something) is doing using credentials issued by Password Vaulting and limiting the commands they can use.

• Unix-optimised privileged account management: a single-interface PAM solutions suite for Unix and Linux environments.

One Identity optimises privileged account management through management and security tools for the AD environment, including a minimum privilege management model for AD Administrator users.

• Privileged Account Governance – governance functions for privileged accounts, application access and access to unstructured data are integrated with privilege safe.

The Solution is completed by the functionality provided by Starling Hybrid Subscription, which enables the implementation of Approval Anywhere and 2Factor Authentication functions through One Identity’s Starling SaaS solution.

S2E’s PAM expertise at service of our customers

S2E, with its team of experts, suggests the implementation of One Identity’s PAM Safeguard Solution. The Solution is based on three modules, which ensure compliance with customer functional requirements.

PAM projects are approached through a phased methodology.

By sharing methods and best practices with customers, requirements are collected, and customer use cases are defined, guiding the Solution’s implementation phases, testing and go-live.

S2E offers its customers corrective and evolutionary maintenance services, supporting the evolution of the released platform over time.

One Identity’s IAM solution boasts enterprise installations for global companies with a range of users managed up to hundreds of thousands. Historically present in the Finance and Insurance sector, S2E is demanding and an IAM practice and solutions early adopter. With its unique integration and experience in SAP environments, the solution has established itself in other manufacturing sectors such as Automotive, Large-scale Retail, Retail and Fashion.

One Identity and S2E Success Cases