HAPPY HOLIDAYS FROM THE REMEDIANT TEAM

Blog
Get a Demo
Contact Us
Get a Demo
Menu
Contact Us
Blog
Get a Demo
flameBKGD

Endpoint Hardening

 

Bring Zero Trust to Your Endpoints.
An Identity Layer for EDR.
Contain
Ransomware Faster.

EndpointHardening
SolutionsBKGD

Identities as a Weapon 

Remediant takes an identity centric approach to complement endpoint detection and response. Our founders observed that attackers weaponized identities (specifically, administrator accounts with “always on” 24x7x365 privileges) in the majority of cyber security incidents. 

These accounts create points of exposure (much like hidden open ports) that could easily be hijacked and used to move laterally. On average, at a large enterprise, Remediant finds that the average employee workstation has 480 users with 24x7 admin access (at companies with >15K devices).

Check out our eBook outlining the Four Steps to Measure PAM Attack Surface Management.

infographic-480admin

Privilege and Identity: The Missing Layer in the Cyber Kill-Chain 

XDR, EDR and NGAV have a device-centric view and watch for malicious files/commands but have no visibility to privileged identities. Endpoint solutions can easily miss island hopping/lateral movement & an attacker is posing as a real administrator. Additionally in counter-IR scenarios, an attacker with a compromised admin account can disable endpoint agents.

Remediant focuses on removing standing administrator rights from endpoints. Download our Lateral Movement white paper to learn more →

infographic-30PAM
spiralBKGD

The How and Why of Weaponized Identities

Endpoint-How

How?
Standing administrator rights are used in 74% of ransomware spread, island hopping, & counter incident response. These privileges are typically in the form of privileged group memberships or device level permissions that allow the execution of privileged commands. So, even if a user is not explicitly given access to a specific server or workstation, their domain or group level permissions would allow them access to that server or workstation whenever they need it.

Endpoint-Why

Why? 
Spread through group nesting, over-permissioning and role changes: Administrator rights change over time very regularly, and this is something that a lot of attackers know, and a lot of security teams don't know. Admin rights can change for many different reasons. New members are always added as Help desks and Administrator teams grow. However, old members who leave their teams or the company, aren’t always removed in a timely fashion.

PersStolenCredProGrayBKGD2

Remediant Brings an Identity-centric View to Endpoints with Zero Standing Privilege

Rapid discovery
Constantly scans for administrator rights across the ecosystem.
Repeatable IR Playbook
Designed to minimize breach and business impact.
Single action removal of standing access
To ensure protection even if credentials are compromised.
Low business disruption
No latency added to end users.
XDR/NGAV compatible, single VM deployment
Requires no agents or endpoints.
Zero Trust
No privileged access by default and only granted on a just-in-time, just enough basis after multi-factor authentication (MFA).
brightBKGD

Get a demonstration of Remediant SecureONE today!

See first hand how to stop lateral movement & prevent ransomware attacks by removing 24x7 admin access.