Super User or Super Threat?
-
Upload
observeit -
Category
Technology
-
view
149 -
download
1
Transcript of Super User or Super Threat?
SUPER USER OR SUPER THREAT?KNOW WHEN USERS PUT YOUR BUSINESS AT RISKPresented by Matt Zanderigo and Kevin Donovan
Who is ObserveIT?
Risk of Privileged Access
Examples of Risky Admin Scenarios
Brief Demonstration of ObserveIT
AGENDA
WHO IS OBSERVEIT?
HQ Boston, MA / R&D Tel Aviv, Israel Founded 2006 1,200+ Customers Worldwide $20M Invested by Bain Capital
The leading provider of User Behavior Monitoring for Application Users, Admins and External Vendors
APPLICATION ACCESS
App Admins App Users
PRIVILEGED ACCESS
(Windows Admins, root, DBAs, System Admins,…)
(Developers, IT Contractors, Network Admin,…)
Shared Accounts Named Accounts
Entitlement changes Logging Utilization
PRIVILEGED ACCESS: THE ‘ROOT’ OF
TODAY’S BIGGEST BREACHES
78.8M affected by Anthem breach, DBA
account compromised
56M affected by Home Depot Breach, Privilege Escalation
to Blame
76M affected by JPMorgan Chase breach, obtained admin privileges
Penetrate Establish Foothold
Open shell and run commands to learn
orientation:
• Who Am I?• Host name• Location of directory
service
Escalate Privileges Move Laterally Complete
Mission
Uploads and executes malicious software
Scan memory for active sessions and extract passwords
Hackers attacks:
• URL Interpretation• Input Validation• SQL Injection• Impersonation• Buffer Overflow
LETS EXAMINE AN ATTACK
Hackers Log into AD to get a targeted list of machines
Hackers leverage credentials to compromise data on machines
Provisioning &
Governance
_____________________________________________________
User Monitoring
_____________________________________________________
Password Vaults
_____________________________________________________
PRIVILEGED ACCESS MANAGEMENT
Visual Audit Trail of all privileged user sessions
App & Access usage Reporting
Detailed session analysis: sudo, privileged escalation, backdoors…
Escalated privileges
_____________________________________________________
WHAT SHOULD BE CLOSELY MONITORED AND ALERTED UPON
Configuration
changes _________________________________________
____________
“The enterprise needs deep and real-time insight within
privileged sessions”
Lateral MovementUnauthorized activity
CONFIGURATION CHANGES
Changes via Embedded Scripts
Changes to Active Directory
Changes within Registry Editor
EMBEDDED SCRIPTS
ACTIVE DIRECTORY
Password Resets, Adding Users, Changing Groups, Modifying Access, etc.
REGISTRY EDITOR
Edit and Modify Specific Values• Firewalls• User Access Control • Applications / Software• Windows Components
UNSECURE ‘SHELL’TELNET suffers from security
problems.
TELNET requires a login name and password (when exchanging text).
Hackers can easily eavesdrop using snooper software to capture a login name and the corresponding password even if it is encrypted.
TELNET has been largely replaced by the more secure SSH protocol.
ESCALATED PRIVILEGES
‘rm’ ‘cp’ with ‘sudo’
Creating “backdoors”
‘leapfrog’ logins
‘RM’ ‘CP’ WITH ‘SUDO’
SURMCP
SUDO Into Root Shell
Modifying the Ping Command
CREATING “BACKDOORS”
‘LEAPFROG’ LOGINS
Challenge:
The Board of Directors of Ally Bank established a Privileged User Access (PUA) project for all sessions that are accessing data on 160 servers in-scope for PCI and SOX compliance.
Their 5,000 privileged users represented a significant risk in their organization, so they are rolling out Password vaulting (Lieberman) and needed to implement a monitoring program in parallel
Solution:
Needed a monitoring system to collect, alert, and report on the specific use of applications, functions, or access to specific information
Challenge:
Needed to comply with SOX, HIPAA, PCI mandates surrounding the audit and logging of privileged access to 1,130 servers.
SOX, HIPAA, PCI mandates must include a date/time stamp as well as proof of what happened in all privileged sessions on regulated servers.
Solution:
Holistic view of configuration changes across environment
Real-time alerts and data exported to SIEM (IBM Qradar)
Reports centered around privileged access as a whole