Privileged Session Manager (PSM) is an application cluster that allows you to access, record, and monitor privileged sessions. With PSM, users can be issued privileged access to computers while meeting audit requirements. It enables granting users access to users machines for a specific amount of time, the capability to monitor live their sessions in real-time, and terminate session those sessions at any point and replaying sessions. It also includes time . Sessions can be recorded as well, allowing for the replaying of sessions as needed. Additionally, access policies linked to PSM include time limits, which allow for time-constrained access to credentials and automatic termination of sessions after time limit expiry.
...
Privileged accounts are both a necessity and a liability. These accounts, with their nearly unlimited access to system resources, are essential for everyday IT operations yet abuse of privileged accounts is attributed as the cause of 62% of security breaches. In a Zero Trust model, only the minimal minimum access required should be granted for the minimal time period and if possible, the access should be proxied and monitored.
EmpowerID’s Privilege Session Manager (PSM) acts as a web-based gateway to provide authorized users with RDP or SSH access to Windows or Linux servers but without exposing the servers to actual network access. This dramatically simplifies network security concerns as both users and servers can be anywhere. The only constraint is access between the user and the web interface of the PSM and between the PSM Gateway and the servers they wish to reach. This eliminates the need for costly VPNs which also slow down the user experience and decrease productivity. This Zero Trust approach prevents most common malware and hack exploits which that rely on network connectivity to the servers they are targeting. In addition, strong adaptive identity verification is enforced and sessions can be optionally recorded as videos for later compliance investigation or verification. In all cases, the password of the privileged credential is never revealed to the end user eliminating the potential for sharing or misuse.
...
On Windows, any local admin has access to the cached passwords for the last x (typically 10) users who have logged into that machine. If a hacker can trick a user into opening an email or clicking a link that runs malware on a computer where the user has local admin privileges, the hacker now has access to all cached passwords to install software or mover laterally to target higher value servers. The worst-case scenario would be a hacker gaining access to the credentials of a domain admin that had logged into that PC.
Recent history shows that no one can stop hackers. You can only reduce the damage they can do by seeking to limit where they can go and which cached privileged credentials might be available locally on compromised PCs. That is what is mean meant by zoning or tiering. Zoning can be done at the user access level, just as you work with network controls, like subnets, routing tables, and firewall rules. Microsoft proposes 3 basic tiers for granting credentials in a Windows network: AD domain controllers, servers, and workstations but you can implement as many zones as needed with EmpowerID.
...
EmpowerID discovers computers and virtual machines wherever they may reside. The most popular platforms for running virtual workloads are supported including : Amazon AWS, Azure, and VMware VCenter. EmpowerID also discovers computer objects from your Active Directory or they can be registered manually in friendly web-based workflows. Computer discovery allows admins to maintain an up-to-date inventory of the assets they are managing as well as simplifies the process for configuring servers for PSM access.
...
| Insert excerpt | ||||||
|---|---|---|---|---|---|---|
|
...
Next Steps
Set Up Privileged Session Management
Create Privileged Access Policies
...