Privileged Access is a thorn in the side of information security. Organizations are faced with an explosion of privileged accounts and a rapidly changing IT landscape: internal and external teams want to have privileged access from every location and device.
That causes headaches for many security managers, who need to find a balance between accessibility, availability, accuracy and security of privileged access and the attendant secrets, such as passwords, keys and tokens.
Privileged Access Management (PAM) solutions like centralized password management, multi-factor authentication and session managers are extremely popular, and ensure the effective and secure management of privileged access. But despite these valuable efforts, stolen secrets still present one of the most common causes among hacked organizations. One possible reason is that the PAM solutions mentioned above do not reduce the attack surface area. After all, a privileged account remains a target for as long as it exists.
When a secret for a privileged account is stored somewhere, it is considered to be a ‘standing privileged access’. This term indicates that a privileged account exists, and is therefore a potential target. Although privileged accounts are usually used for periods of a few seconds up to an hour, the secrets remain stored in PAM or elsewhere. Saving secrets is an implicit display of trust in privileged access.
This implicit trust is in direct conflict with the concept of Zero Trust: a popular strategy that aims to eliminate the trust embedded in systems and processes. To use Zero Trust for privileged access, authentication needs to be explicitly trusted instead. That means secrets are no longer stored, and every login attempt must be authenticated anew. This concept is referred to as ‘zero standing access’.
Zero standing access refers to the ‘least privilege principle’: granting precisely enough privileged access for a specific task, with approval for a specific time. The goal of zero standing access is to eliminate all privileged access. That means no passwords, tokens or keys are stored permanently, even in PAM. Authentication is replaced by short-term ‘ephemeral’ certificates.
An ephemeral certificate is issued just-in-time by a Certificate Authority (CA) for immediate use for authentication on a system or application. The CA uses the roles and security policy defined in an Identity and Access Management (IAM) and PAM system to determine when, and under which conditions, an account may make a connection (SSH/RDP/HTTPS). Once the connection is made, the certificate is deleted and no secrets are available anymore, which eliminates any privileged access and reduces the attack surface area. A hacker would have to take over an existing session in order to gain access.
As mentioned above, it is important to find a balance between accessibility, availability, accuracy and security of privileged access:
Accessibility: in both cases, the normal user account can be authenticated using multi-factor authentication before gaining privileged access. The end system to which a connection must be made must accept ephemeral certificates, however. This requires an inventory and check for infrastructure suitability.
Availability: in both cases there is a single point of failure. If the CA or PAM doesn’t function as expected or is unavailable, then privileged access is limited to a certain degree.
Accuracy: the quality of information of a secret in PAM or an ephemeral certificate issued by the CA must be 100 percent correct. A secret in PAM that does not correspond with a secret on the end system will not work. That also applies to a certificate that is not trusted, for example due to a misconfiguration. The frequency and number of certificates used for ephemeral access means that the Public Key Infrastructure (PKI) must be trusted and automated to a high degree.
Security: ephemeral access means that no secrets are permanently available. That dramatically reduces the attack surface area and significantly lowers the risk of being hacked.
Privileged access revolves around secrets like passwords, keys and tokens that need to be available at all times. This ‘standing access’ is implicitly trusted due to the availability of secrets. That conflicts with the Zero Trust strategy, and it increases the attack surface area as well. One solution for this is to stop using secrets and to perform authentication via ephemeral certificates. However, doing so requires a state-of-the-art PKI service and a high level of maturity in the IT organization.
Menu
