The principle of least privilege is a best practice governance concept in which a user or a process is granted the exact and minimum privileges necessary to perform its function. For example, a user account granted to someone who is tasked to work as a technical writer doesn’t need system admin rights, while a developer who is tasked with enhancing an application, doesn’t need access to HR database records.
Principle of least privilege in an organization cannot be achieved just by a one commercial access governance, privileged access management or observability solution or a project. It needs to be an ever-present security best practice adopted by the organization and its various development, service and support teams, then complimented and automated by commercial solutions that specialize in these features.
ObserveID includes a provisioning policy feature with which an organization can setup policy pertinent to specific applications. Each policy can then include default on-boarding access that is granted based on a user type, department, title etc. or other user profile attributes. As-needed additional access for elevated privileges can be requested and put through an approval process. This request for access can be initiated directly in ObserveID or through a Service Desk system integrated with ObserveID.
Organizations can use either a scheduled manager certification campaign, ad-hoc access review or a manager’s access request to reduce or revoke unnecessary root and admin privileges for any given user. Access reviews can also be tied to events where certain non-compliant user actions can trigger a certification. All these different ways to review access effectively minimizes the attack surface and helps safeguard sensitive assets.
ObserveID can be setup with geo-location policies that monitor and audit access of users to connected systems. This greatly will help with defining and monitoring access by users or processes to their intended target assets. Network access that doesn’t match these location-based privileges and assets, can then then trigger alerts to security administrators.
Best practice dictates that privileged access should be time-bound. ObserveID can grant privileged access using a process access request workflow that allows specifying time constraints prior to elevation of privileges. Upon expiration those granted privileges are automatically revoked, thus preventing an entitlement creep or increasing the attack surface of specific accounts. This also alleviates the need to provision and spawn additional accounts for a specific purpose.
With ObserveID, organizations can create separation of duties and privileges using its versatile policy management framework. These policies can span multiple applications in scope and can discover, alert and fix violations thus keeping organizations safe and compliant. For example, a standard user account policy when applied and active on certain user account types of a connected application, can execute process that both alert and fix accounts when an administrative privilege is incorrectly is detected as a violation.
ObserveID includes a rich enterprise auditing feature which allows tracking and tracing in order to provide requisite oversight on actions that could be potentially be deemed non-compliant with the organizational policies.
ObserveID implements a password safe feature where privileged accounts can be checked out with one-time-password (OTP) until an activity is completed. Once the activity is completed, the account is checked-back in and the password changed.
ObserveID includes monitoring and aggregation features where data is tracked on both carbon/user and non-carbon/service accounts. This type of monitoring can range from specific data attributes of what that access entailed to recording keystrokes and screens.
ObserveID has a strong access review/certification campaign feature. Organizations can generate scheduled or ad-hoc access reviews for both carbon and non-carbon privileged accounts aggregated from all connected systems. The carbon privileged accounts encompass all user types i.e., employees, contractor and/or vendors. Non-carbon accounts include service or application accounts. These access reviews can be performed by managers or system owners at a pre-determined frequency to ensure access is matched to roles and responsibilities of user within that organization.