REMEDIANT IS NOW PART OF NETWRIX  READ PRESS RELEASE

Blog
Get a Demo
  • There are no suggestions because the search field is empty.
Contact Us
Get a Demo

Customer Stories

    Use Cases

     

    Watch this video to learn about Zero Standing Privilege (2:08)
    Blog
    Get a Demo
    • There are no suggestions because the search field is empty.
    Contact Us
    Get a Demo

    Customer Stories

    Use Cases

     

    Watch this video to learn about Zero Standing Privilege (2:08)
    Menu
    Contact Us
    Blog
    Get a Demo
    • There are no suggestions because the search field is empty.
    download-lp

    How PAM violates Zero Trust

    Introduction

    The credential has become a commodity that will be breached. 74% of breached organizations admitted the breach involved access to a privileged account. In addition, The Verizon Data Breach Investigations Report found that out of all attacks, 29% of total breaches involved the use of stolen credentials, second only to phishing. Once a credential is compromised, privileged access management solutions are rendered useless.

    The underlying reason behind this (and why administrator credentials continue to be low hanging fruit for attackers) is the access the credentials provide. Specifically, it is the 24x7x365 always on, high levels of access that these administrator credentials provide that can be used to move laterally across a network, steal sensitive data, or deploy ransomware. The average privileged access management or endpoint privilege management solution was not purpose built to address this risk. 

    This key risk is called “standing privilege” and the emerging security model that addresses the risk is called Zero Standing Privilege.
    Gartner-Cool-Vendor-2019-remediant

    Learn what Gartner says about Zero Trust and Removing Standing Privilege.
    Download the Report

    What is Standing Privilege?

    Standing privilege refers to administrator accounts with “always on” 24x7x365 privileged access. On average, at a large enterprise, we find 480 users with admin access to the average employee workstation (at companies with >15K devices).

    480

    Average number of admins with 24x7 access to each workstation.

    1,291

    Admins with access to more than 2,000 systems

    31,814

    Systems with more than 800 privileged access users


    How does this occur?

    These privileges are typically in the form of privileged group memberships or device level permissions that allow the execution of privileged commands. So, even if a user is not explicitly given access to a specific server or workstation, their domain or group level permissions would allow them access to that server or workstation whenever they need it.

    domin-counter
    For more information about how standing privilege manifests itself and proliferates across a network, Dr. Shane Shook from ForgePoint Capital provides a great overview here.

    Why does this occur?

    There are three key reasons why standing privilege is prevalent:

    1

    First, access is given through groups to IT Helpdesk and Server Admins to resolve issues quickly.


    In most cases, organizations provide this level of 24x7x365 access to enable administrators to do their jobs effectively. The two personas we see with this type of access are IT Helpdesk users and systems administrators.
    2

    Second, managing groups at a granular level becomes very complex very quickly.


    So, admins always have more access than they need.
    3

    Third, administrator rights change over time very regularly, and this is something that a lot of attackers know, and a lot of security teams don't know.


    Admin rights can change for many different reasons. New members are always added as Help desks and Administrator teams grow. However, old members who leave their teams or the company, aren’t always removed in a timely fashion. Group membership changes, so if an active directory group confers some amount of privileged access and the membership of that group changes, then the amount of privileged access in the ecosystem correspondingly changes. Local accounts might be added or removed, conferring or removing levels of privileged access, and GPOs can change, which can confer privileged access across the entire enterprise for a set of accounts or a set of groups.

    What this ultimately results in is an invisible sprawl of administrator access across the enterprise that is available 24x7x365 and more importantly, available to an attacker from the average employee workstation. If an attacker is able to phish their way into an average employee’s workstation, they now have the proverbial “keys to the kingdom.”

    Why does this matter?

    This standing access increases an organization’s attack surface and can impact the network as follows:
    1

    One compromised password exposes the entire network.
    2

    Standing credentials are the primary mode of ransomware spread - Each standing privileged account is an opening to move laterally.
    3

    Violates principle of least privilege – even with a Privileged Access Management solution in place that touts “zero trust.”


    This is why 74% of breached organizations admit that their breach involved a compromised privileged credential.

    Addressing the Problem

    The reason we as an industry have failed miserably at addressing standing privilege is because we struggle to answer two simple questions:
    1

    What admin credentials exist and have standing access? You cannot protect what you do not know exists. 
    2

    How do you protect them?


    Zero standing privilege is an emerging, reframed approach to privileged access management (PAM) that addresses both questions.

    How to Achieve Zero Standing Privilege?
    If we agree that standing privilege is defined as that accounts have persistent privilege access for all time on some set of systems. Zero standing privilege is the exact opposite.