Privileged Account Management and BYOD: PAM for Dummies Part II
[fa icon="calendar"] Jun 28, 2016 5:30:00 AM / by WALLIX
Is that an iPhone in your pocket or are you just happy to be reading about the security consequences of Bring Your Own Device (BYOD) policies?
Welcome to the second installment of our "PAM for Dummies" blog series.
In our first article on PAM for Dummies, we defined privileged account management (PAM). In Part 2, we're discussing the relationship between BYOD and PAM. BYOD, the policy of encouraging employees to bring and use their own personal devices (as opposed to supplying company equipment) is often an important organizational requirement, but exposes the organization to new risks that must be mitigated.
BYOD is Happening, Even if You Don't Want It
BYOD polices now predominate, with industry data suggesting that Enterprise BYOD adoption is up to 75%. Osterman Research, an analyst firm, noted that there are now twice as many personal devices (e.g. iPhones, iPads) in the workplace as corporate-issued. The consensus seems to be that banning personal devices simply doesn't work. Essentially, your organization already has BYOD even if you don't officially allow it.
Security Risks Exposed by BYOD
The introduction of any new technology into the workplace changes the organizations' risk profile. One can imagine a feverish scramble to invent sealing wax as a countermeasure to the invention of quill pens and parchment a millennium ago. (Your Majesty! Thou must be assured of the discretion of thy missives to thine knights and vassals!)
Enabling workers to bring their personal phones and tablets to work boosts productivity and morale. At the same time, the practice expands what security professionals call the "perimeter". The perimeter, whose name comes from the army's ring of mines and barbed wire surrounding a fortification, used to pretty much just consist of the network. If the firewall was working, the perimeter was fairly well defended. The Internet changed that equation, allowing hordes of potential intruders inside the firewall. Firewalls adapted and security policies got strengthened against Internet-borne vectors of attack. However, the mobile revolution has now cut another big hole in the perimeter.
A thief who steals your vacationing employee's cell phone (with up to 128 GB of data) just got inside your perimeter, even if he or she is in Bali. According to Osterman Research, only one in four devices can be remotely wiped. A lost or stolen phone lets your data float out into the world unprotected. That's bad.
Other BYOD security risks include:
A lack of visibility into the activities of malicious actors who use mobile devices to attack your data.
Malware delivered by mobile devices remotely.
Malware used to hijack a mobile device that has remote access to confidential data and internal systems of records (the user won't even know that his or her phone is being used to breach the enterprise.)
Inability to lock down devices that are not owned or controlled by the organization.
Accidental non-compliance, e.g. a mobile device in the EU that carries personally identifiable data across borders, in violation of EU Privacy Laws.
The Role of Privileged Accounts in BYOD Security
You shouldn't fret too much about BYOD security in general. Your IT department undoubtedly has a number of smart people working on the issue and implementing a number of best-practices, policies and technologies to mitigate BYOD risk. These include things like a company app store, a mobile portal, device management and app management platforms and security measures specifically designed to control access by mobile devices. Ready for the catch?
These best practices are only as good as the people who run them. The administration of BYOD security solutions relies on sound management of privileged accounts. A privileged user has "root access" to the "back end" of systems that run your business. Often called "admin users," the privileged user can set up, modify or delete accounts. He or she can change settings on systems of record, altering user roles and peering into data that may be off limits.
Privileged users are typically highly trusted individuals. However, they still represent a serious vulnerability:
Privileged user accounts may be compromised, allowing a malicious actor to pose as a privileged user to wreak havoc. Some of the worst security breaches in recent memory were executed by hackers posing as privileged users.
Privileged users may create a security risk by mistake, for instance by setting up a firewall with the wrong ports open.
In some rare cases, Privileged users may themselves act maliciously.
Privileged users affect the quality of security in the policies and technologies that govern BYOD:
Company app stores and private mobile portals
Privileged users control which versions of apps are available and who can access them. They also control the setup and configuration of the store. They may integrate access controls for the portal with the organization's main identity management system.
Device management and app management
Systems that manage devices and apps are set up and administered by privileged users. Privileged users can set the parameters of mobile device and app provisioning. They can also access and potentially modify the audit logs of these systems.
Mobile security logs
Logs are extremely important in keeping track of mobile device activity. Privileged users set up and manage the systems that log mobile activity. As a result, the systems are vulnerable to overrides and other processes that can obscure malicious activity from auditors.
Mobile security tokens
Technologies such as OAUTH, which enable a non-human user (e.g. a system at a partner firm) to "vouch" for a mobile device used by an employee, are vulnerable to security breaches. Again, privileged users control systems that manage the tokens.
Technology that helps you stay on top of privileged access is called a "Privileged Access Management" or "Privileged Account Management" (PAM) solution. It keeps your organization safe from accidental or deliberate misuse of privileged accounts. PAM offerings vary widely but most provide a secure, streamlined way to authorize and monitor all privileged users. For BYOD, PAM can:
Monitor access to privileged mobile management account access in real time and flag or halt activities that are suspicious.
Grant mobile admin privileges to users only for systems on which they are authorized.
Grant access only when it's needed and revoke access when the need expires.
Centrally and quickly manage access all of your systems that govern BYOD policies.
Create an audit trail of privileged operations affecting BYOD policies.
The bottom line is that BYOD makes abuse of your systems and data easier and no BYOD best-practice policies can stop privileged users from wreaking havoc except Privileged Access Management.
Getting the Right PAM Solution for BYOD
You probably already have a PAM solution of some kind operating in your organization. How can you tell if it is the right one to help secure BYOD policies? Given that BYOD introduces new platforms, such as mobile device management, the PAM solution must be able to easy to deploy with many new devices and systems. Adaptability and ease of use are essential in this regard. PAM solutions are notoriously difficult to use. When that happens, privileged users often ignore or work around them, leaving your organization exposed to the very risks PAM is supposed to mitigate.
WALLIX solves this problem with a PAM solution that is easy to deploy with virtually any devices or platform. It's simple and efficient to maintain, able to work with virtually any privileged account, including those required by platforms that manage mobile devices and the like.
What's our secret? We have designed our solution as "agent-less." Unlike a lot of other PAM solutions, WALLIX doesn't force the IT department to install special software on every system where they are managing privileged access. This kind of limitation can inhibit effective PAM for BYOD. Instead, WALLIX gives you the tools to make PAM an enduring, pervasive and consistent force in your mobile security and compliance efforts.
For more information about PAM and BYOD, contact us and we can walk you through the implications of your BYOD program and how to mitigate the security risks it creates.
Topics: Preventing Insider Threat