Privileged Account Management and BYOD

BYOD policies now predominate, with industry data suggesting that Enterprise BYOD adoption is up to 75%.  Osterman Research, an analyst firm, noted that there are now twice as many personal devices (e.g. iPhones, iPads) in the workplace as corporate-issued. The consensus seems to be that banning personal devices simply don’t work. Essentially, your organization already has BYOD even if you don’t officially allow it.

Security Risks Exposed by BYOD

The introduction of any new technology into the workplace changes the organizations’ risk profile.  One can imagine a feverish scramble to invent sealing wax as a countermeasure to the invention of quill pens and parchment a millennium ago. (Your Majesty! Thou must be assured of the discretion of thy missives to thine knights and vassals!)

Enabling workers to bring their personal phones and tablets to work boosts productivity and morale.  At the same time, the practice expands what security professionals call the “perimeter”. The perimeter, whose name comes from the army’s ring of mines and barbed wire surrounding a fortification, used to pretty much just consist of the network. If the firewall was working, the perimeter was fairly well defended. The Internet changed that equation, allowing hordes of potential intruders inside the firewall.  Firewalls were adapted and security policies got strengthened against Internet-borne vectors of attack. However, the mobile revolution has now cut another big hole in the perimeter.

A thief who steals your vacationing employee’s cell phone (with up to 128 GB of data) just got inside your perimeter, even if he or she is in Bali. According to Osterman Research, only one in four devices can be remotely wiped. A lost or stolen phone lets your data float out into the world unprotected. That’s bad.

Other BYOD security risks include:

• A lack of visibility into the activities of malicious actors who use mobile devices to attack your data.
• Malware is delivered by mobile devices remotely.
• Malware is used to hijack a mobile device that has remote access to confidential data and internal systems of records (the user won’t even know that his or her phone is being used to breach the enterprise.)
• Inability to lock down devices that are not owned or controlled by the organization.
• Accidental non-compliance, e.g. a mobile device in the EU that carries personally identifiable data across borders, is in violation of EU Privacy Laws.

The Role of Privileged Accounts in BYOD Security

You shouldn’t fret too much about BYOD security in general. Your IT department undoubtedly has a number of smart people working on the issue and implementing a number of best practices, policies, and technologies to mitigate BYOD risk. These include things like a company app store, a mobile portal, device management, and app management platforms and security measures specifically designed to control access by mobile devices.  Ready for the catch?

These best practices are only as good as the people who run them. The administration of BYOD security solutions relies on the sound management of privileged accounts. A privileged user has “root access” to the “back end” of systems that run your business. Often called “admin users,” the privileged user can set up, modify or delete accounts. He or she can change settings on systems of record, altering user roles and peering into data that may be off-limits.

Privileged users are typically highly trusted individuals. However, they still represent a serious vulnerability:

• Privileged user accounts may be compromised, allowing a malicious actor to pose as a privileged user to wreak havoc. Some of the worst security breaches in recent memory were executed by hackers posing as privileged users.
• Privileged users may create a security risk by mistake, for instance by setting up a firewall with the wrong ports open.
• In some rare cases, Privileged users may act maliciously.

Privileged users affect the quality of security in the policies and technologies that govern BYOD:

Company app stores and private mobile portals

Privileged users control which versions of apps are available and who can access them. They also control the setup and configuration of the store. They may integrate access controls for the portal with the organization’s main identity management system.

Device management and app management

Systems that manage devices and apps are set up and administered by privileged users.  Privileged users can set the parameters of mobile devices and app provisioning. They can also access and potentially modify the audit logs of these systems.

Mobile security logs

Logs are extremely important in keeping track of mobile device activity. Privileged users set up and manage the systems that log mobile activity. As a result, the systems are vulnerable to overrides and other processes that can obscure malicious activity from auditors.

Mobile security tokens

Technologies such as OAUTH, which enable a non-human user (e.g. a system at a partner firm) to “vouch” for a mobile device used by an employee, are vulnerable to security breaches. Again, privileged users control systems that manage the tokens.

Privileged Access Management

Technology that helps you stay on top of privileged access is called a “Privileged Access Management” or “Privileged Account Management” (PAM) solution. It keeps your corporate data safe from accidental or deliberate misuse of privileged accounts. PAM offerings vary widely but most provide a secure, streamlined way to authorize and monitor all privileged users. For BYOD, PAM can:

• Monitor access to privileged accounts from mobile devices in real-time and flag or halt activities that are suspicious.
• Grant mobile admin privileges to users only for systems on which they are authorized.
• Grant access only when it’s needed and revoke access when the need expires.
• Centrally and quickly manage access to all of your systems that govern BYOD policies.
• Create an audit trail of privileged operations affecting BYOD policies.

The bottom line is that BYOD makes abuse of your systems and data easier and no BYOD best-practice policies can stop privileged users from wreaking havoc except Privileged Access Management.

Getting the Right PAM Solution for BYOD

You probably already have a PAM solution of some kind operating in your organization. How can you tell if it is the right one to help secure BYOD policies? Given that BYOD introduces new platforms, such as mobile device management, the PAM solution must be easy to deploy with many new devices and systems. Adaptability and ease of use are essential in this regard. PAM solutions are notoriously difficult to use. When that happens, privileged users often ignore or work around them, leaving your organization exposed to the very risks PAM is supposed to mitigate.

WALLIX solves this problem with a PAM solution that is easy to deploy with virtually any device or platform. It’s simple and efficient to maintain, able to work with virtually any privileged account, including those required by platforms that manage mobile devices and the like.

What’s our secret? We have designed our solution as “agentless.” Unlike many other PAM solutions, WALLIX doesn’t force the IT department to install special software on every system where they are managing privileged access. This kind of limitation can inhibit effective PAM for BYOD. Instead, WALLIX gives you the tools to make PAM an enduring, pervasive, and consistent force in your mobile security and compliance efforts.

Learn more about the theory behind access security and how it is implemented by downloading WALLIX’s ‘Beginner’s Guide to Access Security’ whitepaper.