REMEDIANT IS NOW PART OF NETWRIX 
Watch this video to learn about Zero Standing Privilege (2:08)
Watch this video to learn about Zero Standing Privilege (2:08)
REMEDIANT IS NOW PART OF NETWRIX
Watch this video to learn about Zero Standing Privilege (2:08)
Watch this video to learn about Zero Standing Privilege (2:08)
Remediant takes an identity centric approach to complement endpoint detection and response. Our founders observed that attackers weaponized identities (specifically, administrator accounts with “always on” 24x7x365 privileges) in the majority of cyber security incidents.
These accounts create points of exposure (much like hidden open ports) that could easily be hijacked and used to move laterally. On average, at a large enterprise, Remediant finds that the average employee workstation has 480 users with 24x7 admin access (at companies with >15K devices).
Check out our eBook outlining the Four Steps to Measure PAM Attack Surface Management.
XDR, EDR and NGAV have a device-centric view and watch for malicious files/commands but have no visibility to privileged identities. Endpoint solutions can easily miss island hopping/lateral movement & an attacker is posing as a real administrator. Additionally in counter-IR scenarios, an attacker with a compromised admin account can disable endpoint agents.
Remediant focuses on removing standing administrator rights from endpoints. Download our Lateral Movement white paper to learn more →
How?
Standing administrator rights are used in 74% of ransomware spread, island hopping, & counter incident response. These privileges are typically in the form of privileged group memberships or device level permissions that allow the execution of privileged commands. So, even if a user is not explicitly given access to a specific server or workstation, their domain or group level permissions would allow them access to that server or workstation whenever they need it.
Why?
Spread through group nesting, over-permissioning and role changes: Administrator rights change over time very regularly, and this is something that a lot of attackers know, and a lot of security teams don't know. Admin rights can change for many different reasons. New members are always added as Help desks and Administrator teams grow. However, old members who leave their teams or the company, aren’t always removed in a timely fashion.
See first hand how to stop lateral movement & prevent ransomware attacks by removing 24x7 admin access.