Privileged Session Manager (PSM) is a collection of applications that facilitate accessing, monitoring, and recording privileged sessions , while ensuring compliance with auditing requirements. PSM enables authorized users to obtain privileged access to computers, with the flexibility to limit access to specific timeframes, monitor sessions in real - time, and terminate sessions at any time. PSM provides the ability to record sessions, which can be replayed as necessary. Moreover, access policies associated with PSM include time limits that allow time-constrained access to credentials and automatic session termination after the time limit expires.
...
EmpowerID's Privilege Session Manager (PSM) provides a web-based gateway for authorized users to access Windows or Linux servers through RDP or SSH without exposing the servers to direct network access. This approach simplifies network security concerns, as users and servers can be located anywhere. The only requirements are access between the user and the PSM web interface , and between the PSM Gateway and the target servers. This eliminates the need for costly VPNs, which can slow down user experience and decrease productivity. This Zero Trust approach effectively prevents most common malware and hacking exploits that rely on network connectivity to the target servers. Furthermore, PSM enforces strong adaptive identity verification, and sessions can be recorded as videos for compliance investigations or verification purposes. In all cases, the password of the privileged credential is never disclosed to the end user, reducing the potential for sharing or misuse.
...
On Windows, local administrators can access the cached passwords of the last x (usually 10) users who have logged into that computer. If a hacker can trick a user with local admin privileges into running malware on their computer, the hacker can access all cached passwords, potentially installing software or moving laterally to target higher-value servers. The worst-case scenario is when the hacker gains access to domain admin credentials that were used to log into the compromised computer.
...
EmpowerID PSM is a valuable tool for enforcing a Zero Trust zoning or "micro-segmentation" strategy. PSM enables organizations to use pre-provisioned shared accounts for server access without revealing the passwords or elevating the access of the user's existing account. EmpowerID administrators explicitly define which vaulted privileged credentials will be available for use by administrators for specific servers , by zone. This is a best practice to avoid lateral movement or pass-the-hash attacks.
...
Access: With Privileged Session Manager, users can only access resources for which they have been granted permission. Users can request access and initiate a connection through the IAM Shop application. All sessions are proxied to the target resources through PSM servers, which provides provide extensive control over transmitted communication.
Live Monitoring, Recording, and Replay: Administrators can monitor live sessions (if the policy allows it), record sessions, and replay them for review, all from the EmpowerID website.
Credential Sharing: Computer credentials are encrypted and are used to initiate privileged sessions with the target resource upon request for automatic login. These credentials are not exposed to users, thereby enhancing security.
Auto-Login: When combined with Privileged Access Manager, Privileged Session Manager can be configured for automatic login, which improves security and compliance by not exposing account credentials to users.
...
The PSM cluster consists of 3 dockerized Node.js applications, each with their its own responsibilities.
Application
Daemon
Uploader
Session Flow
Below is the UML diagram that outlines a session from initiation to viewing recorded session at the endThe below image depicts the flow that occurs during a PSM session. A description of the flow follows the image.
...
User authenticates.
User requests access to a computer by checking-out a credential from the list of available credentials.
User clicks the login icon to initiate the RDP session and is prompted to enter their Master password.
The connection request is submitted to the PSM Application along with the master password that the user enters.
The PSM Application talks to an EmpowerID API Endpoint to authorize and receive the credentials to the target resource.
If the authorization is successful EmpowerID returns the credentials to the PSM application server.
The PSM Application connects to the target resource through the Daemon with the corresponding protocol.
Input from the browser and response from the server are exchanged through a websocket connectionreceives an access token, which is used to determine their access.
User initiates a privileged RDP or SSH session to a computer to which they have been granted access using the credentials the system assigns for the specified session.
The Privileged Access Service requests the user’s master password.
Upon successful submission of the master password, the Privileged Access Server used the session connection information to determine where the computer lives and communicates with the PSM Gateway in that zone.
| Insert excerpt | ||||||
|---|---|---|---|---|---|---|
|
...
Set Up Privileged Session Management
Create Privileged Access Policies
Enable Computers for Privileged Session Management
...