Top 3 Risks of Not Having a Privileged Access Management System

Managed services providers (MSPs) are living in a world in which security threats come at them from every angle. Malware and spear phishing can wreak havoc on your customers’ businesses via malicious emails and the BYOD trend has created new issues with compliance—there’s a lot to keep an eye on! As such, you may be tempted to focus all of your energy on preventing external threats while neglecting the reality of internal or insider threats.

According to the Verizon 2019 Data Breach Investigations report, insiders were responsible for 34% of all breaches in 2018, and that percentage might be a conservative estimate since 70% of insider attacks each year go unreported. Savvy MSPs know that identity management and privileged access management systems dramatically reduce the likelihood of a successful insider attack.

However, if you don’t have Identity and Access Management (IAM) and Privileged Access Management (PAM) systems in place and believe your other network security protocols sufficiently protect your customers, it might be easy to think, “what’s the worst that can happen?” As it turns out, not having a privileged access management system can make enterprises vulnerable in several ways. To paint a more complete picture of the potential damages, let’s discuss the top three risks of not using a privileged access management system in an enterprise.

What is identity and access management?

Identity and access management (IAM) is a subsection of IT security that includes frameworks and solutions for managing digital identities. Every user has a unique digital identity they carry with them from site to site or account to account, and access controls for these different sources can vary. IAM helps ensure digital identities in an enterprise have access to the networks, databases, applications, and accounts they need access to, but only within the right context.

Role-based access controls (RBAC) are a great example of IAM technology. With RBAC, employee access to different systems and data sources is based on their roles and responsibilities within the organization. Although access can fluctuate as employees advance or move throughout the enterprise, it’s strictly defined once they get there—this way everybody has access to exactly what they need, and nothing they don’t.

Key IAM functions include:

• Provisioning, de-provisioning, and authenticating user access
• Using employee data to define roles
• Supporting technologies like multi-factor authentication (MFA)
• Enabling and restricting access according to system policies
• Managing passwords across the enterprise

IAM is a great security system to have, but it doesn’t have the granular access control MSPs need to manage privileged accounts and permissions. For example, an identity management solution can’t help you enforce the principle of least privilege. When you layer privileged access management on top of IAM, you unlock a more comprehensive solution.

Privileged access management (PAM) is like IAM, but with extended capabilities to manage privileged accounts. Privileged accounts, like domain administrative accounts or firecall accounts, provide access and privileges to users with fewer privileges. As such, privileged accounts need more regulation and protection because they encounter more critical systems and sensitive information. The primary objective of PAM is to enforce the principle of least privilege, which states that users should only have the minimum amount of access necessary to perform routine duties.

The benefits of privileged access management include

• Better protection against internal and external threats
• Help meet compliance mandates by providing access controls and reporting
• Increased operational efficiency
• Encrypted access to accounts from a central location

Risks MSPs face without a privileged access management system

Having a privileged access management system is a necessity, not a luxury. Without it, you expose yourself and your customers to these three critical risks and more.

1. Cyberattacks

Users with privileged accounts are tapped into an enterprise’s most critical systems. Not only do these accounts have the highest clearance levels, but they also manage and regulate smaller accounts with fewer privileges. In some cases, teams sync their accounts and passwords with a privileged account so it’s easier to collaborate and share information. Unfortunately, this interconnectivity poses a serious security risk.

If a cyberattacker were to gain access to just one privileged account, they could easily use that access to hold data at ransom, lock out accounts, install backdoors, and shut the entire network down. Without an identity management system to clearly partition roles and access requirements, one mismanaged account can put your entire system at risk.

To make matters worse, a lack of a privileged access management system means that MSPs must worry about more than attacks from bad actors outside of the enterprise. If an employee leaves the company and their account isn’t immediately deprovisioned, any sensitive information stored on their account leaves with them. A cyberattacker might steal that information from their phone or tablet, or a disgruntled employee might intentionally try to compromise the business.

2. Decentralized privileged access management

It’s important to have a privileged access management system, but not just any PAM will do. Due to budgetary constraints, some smaller enterprises settle for piecemeal privilege security controls or try to manage access manually. A decentralized system can lead to inconsistent policy enforcement across the enterprises, which can be just as bad as having no policies at all. Further, even the best IT team will likely have trouble scaling appropriately and managing all of a growing company’s accounts, permissions, credentials, and assets. A decentralized or manual privileged access management system inevitably leaves security gaps that bad actors can exploit.

3. Unsecured password management

When new applications or accounts are installed, users often immediately set passwords that are overly simplistic or are already used across their other accounts. They do these things so they can more easily remember their passwords. Unfortunately, cyberattackers can also easily guess these passwords. What’s more, there’s no guarantee employees change them when necessary. Without privileged access management systems, MSPs also miss out on the benefits of a network password manager.

Privileged access management best practices

To best protect themselves and their customers, MSPs should apply these three privileged access management best practices:

1. Enforce the principle of least privilege
2. Invest in a comprehensive PAM solution
3. Establish and enforce password management best practices

N‑able^® Passportal can help MSPs more easily accomplish the above goals. Passportal is a cloud-based password protection and IT documentation management system that helps MSPs automatically regulate their customers’ passwords across the enterprise.

Credentials and passwords are stored in an encrypted vault behind layers of role-based permissions and multi-factor authentication. As a document management system, this tool standardizes documentation—from passwords to assets—to help ensure that nothing falls through the cracks. This helps you protect your customers and demonstrate compliance.