Management of privileged accounts: 5 key recommendations to protect your Information System The administration of the information system (IS) of companies and organizations are based on privileged accounts. Privileged accounts rely on the trust placed in their users. Whether internal or external administrators, privileged users have the power to make substantial changes to the IS and therefore have a heavy responsibility concerning the IT security; they have the power to take actions that may harm the company or organization for which they operate. Users with privileged access are able to install and delete programs or access sensitive data from the organization they are responsible for. In terms of IT security, failures related to the human factor must be taken into consideration. Indeed, both by involuntary acts (theft of credentials after a “social engineering” operation or phishing, loss of a computer without encrypted partition, etc.) or by premeditated acts, the human factor is often the first cause of security incidents on the IS. If a “common” user loses his credentials or if they are stolen, the usurper will be able to access all his data; if, in addition, he is also a privileged user, then the usurper can access the IS and compromise it or steal confidential information. Considering the importance of these issues, it is therefore essential for organizations to monitor these privileged accounts and record privileged users’ sessions in order to keep track of the actions performed and, in the event of malicious actions, to be able to prove them. To address these security issues related to privileged users, the ANSSIAgence Nationale de la Sécurité des Systèmes d’Information. The National Cybersecurity Agency of France (ANSSI) is a French government organisation reporting to the Secretary General for Defence and National Security... More (the French National Cybersecurity Agency) lists a series of questions [01] that CISOs and CIOs must ask themselves. The following 5 fundamental recommendations can be extracted from them: Limit the number of privileged accounts: the privilegesmust only be held by persons for whom it is essential to the execution of their duties and, above all, it should be granted only for the period of time strictly necessary. Individual password: Each administrator must have a personal password to facilitate the traceability of actions. Passwords should not be shared, and common passwords should not exist. Separation of workstations: An administrator workstation should only be used for administration tasks. Administrators must use an account without privileges for any other tasks, such as internet browsing. Analyze event logs: A connection during the night or on Sundays, outgoing flows to addresses with exotic destinations… It is important to evaluate potentially suspicious actions that have been carried out. An alert system must also be set up to be able to react quickly. Delete old accounts: Once a privileged user leaves the company, his account must be deleted immediately to avoid any risk of potentially unauthorized use. Temporary administrators (temporary contracts, service providers) must have an account that automatically expires at the end of the contract, even if it may have to be extended in the event of contract renewal. Implementing an identity and authorization management solution, such as Systancia Identity, formerly Avencis Hpliance, allows to effectively meet this challenge. In addition to these aspects, which are in some cases of an organizational type and can therefore be quickly implemented in any organization, it would be necessary to implement solutions dedicated to monitoring privileged users (or Privileged Access Management – PAMPrivileged Access Management. PAM is a technology for managing access and authentication of authorized users, usually information system administrators, to administrative resources or applications. The main objective is to secure... More). PAM solutions allow to record privileged users’ sessions and make it possible to set up configurable alerts with automatic actions in the event of suspected malicious behavior. Through its PAM solution, Systancia Cleanroom, Systancia responds to these monitoring challenges and goes further than traditional PAM solutions by providing a technical response to the separation of uses between user and administrator, as described in article [02]. An OpinionWay survey [03] conducted in August 2018 for Systancia revealed that 72% of companies do not have a dedicated environment to perform administration tasks on their information system. The Cleanroom concept provides an answer to the workstation separation issue and allows CIOs and CISOs to entrust the information system for which they are responsible to privileged users in complete security. Discover Systancia Cleanroom [01] Avez-vous oublié les fondamentaux ? – ANSSI https://www.ssi.gouv.fr/entreprise/precautions-elementaires/avez-vous-oublie-les-fondamentaux-2/ [02] The Cleanroom concept for a safe and secure administration [03] OpinionWay survey for Systancia: The CIOs rate the IT security of their companies, September 2018 https://www.systancia.com/en/exclusive-opinionway-survey-for-systancia-the-cios-rate-the-it-security-of-their-companies/