Rise of the Machines: Not All Privileged Users Are People
In complex, complicated networks, privileged access is a fact of life – and privileged access management (PAM) is a necessity. The need for PAM stems from the fact that users will need varying levels of privileged access at different times and under different circumstances: In-house DBAs will need access to database servers to perform their daily work, for example, while network engineering consultants will need a completely different set of privileges in order to accomplish certain tasks for which they’ve been retained.
Users of a System Are Not Always People
But what is often overlooked in discussions about PAM is that privileged users are not necessarily people. This is often the case in IoT deployments, and particularly true of Industrial IoT (IIoT) deployments, where certain system components and processes are often used to control other components without human intervention – and thus require their own privileged access in order to accomplish the tasks that are required of them.
To illustrate this need, consider an example drawn from a chemical manufacturing company with storage tanks whose contents must be kept at a certain temperature and pressurization. Engineers will have privileged access to the tank control software in order to make necessary adjustments – but the company has also installed an IIoT system of sensors and control components to monitor and adjust the storage tank conditions when no engineer is on duty. In order to do their job, the IIoT components will require the same privileged access as the engineers. Just as the privileged access of the engineers must be managed, so too must the privileged access granted to the IIoT system: It should have access to no resources other than those required to do its job (i.e., tank sensors and controls). Limiting and isolating access rights to a particular resource means protecting the rest of the network in the event the connected equipment is hacked, or the network is breached.
Machine-Level Privilege is Already a Reality
This need for machine-level PAM is not just theoretical: As progressively more manufacturing systems become connected to the outside world, they also become exposed to cyberattacks that were not previously possible. And because IoT devices are very often small, Linux-based computers in their own right, an attacker who gains control of such a device can use it in attempts to access and control other system components.
All of which points, again, to the need for appropriate privileged access management of system components themselves. If a proper PAM solution controls privileged access within the network, even were a hacker to gain control of an IoT device they will not be able to use it to gain further access: Because the device itself has not been granted extraneous privileged access, and is effectively isolated from all other critical assets, any attempts by a hacker to exploit it should be terminated by the PAM system.
Privilege Without Management is Dangerous
The converse is also true, however: If IoT components have been granted unfettered privileged access either because no PAM system is in place, or because the components are not subject to it, then a hacker in control of the device will potentially be able to gain further privileged access to any other device that they can see. Again, such exploits are more than theoretical: The Mirai botnet malware that took down much of the internet in late 2016 specifically targeted IoT in order to spread in exactly this way.
None of this is to say that a strong PAM solution will end cyber threats all on its own — it won’t because no single facet of cybersecurity is enough all on its own. Rather, PAM should be thought of as a vitally important piece of securing systems against cyberattacks, and as such, the privileged access that it’s managing should encompass both the human and the machine components of a system.
