BR +55 11 3069 3925 | USA +1 469 620 7643

  • BLOG
  • Português
  • BR +55 11 3069 3925 | USA +1 469 620 7643
  • Português
logo senhasegura
  • SOLUTIONS
  • PRODUCTS
  • SERVICES AND SUPPORT
  • PARTNERS
  • COMPANY
  • CONTACT
  • DEMO

Compliance

and Audit

Audit

PCI DSS

SOX

ISO 27001

HIPAA

NIST

GDPR

ISA 62443 |

Industry 4.0

Security and

Risk Management

Privilege Abuse

Third Party Access

Privileged Access Recording

Insider Threat

Data Theft Prevention

Hardcoded Passwords

Password Reset

Solutions

By Industry

Energy and Utilities

Financial

Government

Health Care

Legal

Telecoms

Retail

senhasegura

Testimonials

See Testimonials

360º Privilege Platform

Account and

Session

PAM Core

Domum

Remote Access

MySafe

GO Endpoint

Manager

GO Endpoint

Manager Windows

GO Endpoint

Manager Linux

DevOps Secret

Manager

DevOps Secret

Manager

Multi

Cloud

Cloud IAM

Cloud Entitlements

Certificate

Manager

Certificate

Manager

Privileged

Infrastructure

PAM Crypto Appliance

PAM Load Balancer

Delivery : On Cloud (SaaS) | On-premises | Hybrid

Services

and Support

Documentation

Solution Center

Suggestions

Training and Certification

Deployment and Consulting

PAMaturity

PAM 360º

Support Policy

senhasegura

Resources

Rich Materials

Customer Cases

Webinars Calendar

senhasegura Stickers

BLOG

CONTENT

Is your company really prepared for a cyber attack?

The Pillars of Information Security

7 signs that your company needs to improve the security of sensitive data

See more articles about cybersecurity

Technical

Information

How it works

Product Archicture

Integration

Security

High availability and contingency

Privileged Auditing (Configuration)

Privileged Change Audit

Features and

Functionalities

ITSM Integration

Behavior Analysis

Threat Analysis

Privileged Information Protection

Scan Discovery

Task Management

Session Management (PSM)

Application Identity (AAPM)

SSH Key Management

Affinity Partner

Program

About the Program

Become a Partner

MSSP Affinity Partner Program

Security Alliance Program

Academy | E-learning for Certification

Affinity

Portal

Portal dedicated only for Partners to find commercial, marketing supporting materials and certification program of senhasegura.

Access Partner Portal

Opportunity

Booking

For our Commercial Team to support your sale more effectively, request your opportunity booking here.

Opportunity Booking Request

Find a

Partner

We work together to offer a better solution for your company.

Check all senhasegura partners

About

Company

About us

Achievements

Why senhasegura

Press Release

Press Room

Events

Career

Presence in the World

Terms of Use

End User License Agreement (EULA)

Privacy and Cookie Policy

Information Security Policy

Certification at senhasegura

senhasegura

Testimonials

See Testimonials

Latest Reports

and Awards

KuppingerCole Leadership Compass Report for PAM 2023

Frost & Sullivan Customer Value Leadership Award 2022

Gartner PAM Magic Quadrant 2021 Report

KuppingerCole Leadership Compass: PAM 2021

GigaOm Radar Report 2021

Gartner PAM Magic Quadrant 2020

Gartner Critical Capabilities for PAM 2020

Information Services Group, Inc. (ISG)

KuppingerCole Leadership Compass: PAM 2020

Contact our team

Request a Demonstration

CIS Controls – PAM x 20 Controls Focused on PAM

by senhasegura Blog Team | Sep 26, 2019 | BLOG

The Michaelis Dictionary defines risk as the likelihood of damage in a given project or thing due to an uncertain event. This definition applies to anything that may expose people and organizations to risk, including Information Security. In this specific context, we can state that cyber-security risk is the likelihood of this damage to occur as a result of the use of interconnected systems. With this in mind, it is possible for those responsible for Information Security to be clear about the actions to be taken to mitigate these risks, that is, to prevent organizations from suffering such damages.

To assist in defining strategies for cyberattack protection, market organizations have created a set of policies and procedures, which is documented for theoretical knowledge, and also practical implementation procedures. Some of these frameworks may, in some cases, be designed for a specific industry, and are designed to reduce unknown vulnerabilities and configuration errors in the organizational environment. To summarize, these standards introduce models to allow organizations to understand their security approach and know how to improve it. And as they have been tested in different situations and industries, one can vouch for their confidence and effectiveness.

The industry’s leading cyber-security risk management frameworks, regulations, and standards are the ISO 27000 standards, the NIST’s Cyber-Security Framework, the PCI DSS standard, and the Center for Internet Security’s (CIS) Critical Security Controls.

CIS is a nonprofit organization that aims to leverage the power of a global IT community to secure public and private organizations against cyber threats. Thus, CIS has defined a set of critical security controls, based on the industry’s best practices, that organizations must implement in their environment to ensure an effective cyber-security strategy. These critical controls are divided into three distinct sets: basic, foundation, and organizational, totaling 20 controls that address basically all aspects of cyber-security. These are:

Even though CIS’ controls address numerous aspects of Information Security, some of them are directly related to Privileged Access Management (PAM). From the 20 controls proposed by CIS, one specifically addresses PAM, while the other 19 are influenced or effectively require the concepts related to PAM.

Privileged Access Management refers to a set of technologies and practices that monitors and manages privileged access (also called administrative access) to critical systems. With a privileged credential, a user can, for example, modify system settings, user accounts, and access critical data.

Thus, given their level of access and control over the systems that manage information or processes, a privileged user exposes the organization to potential business risks. Whether through an attack, privilege abuse, or human error, a privileged user can be an attack vector for a potential security incident.

Control number 4 (controlled use of administrative privileges) directly addresses aspects of PAM. In order to understand how a PAM solution can fully address this control, let’s present the CIS-provided sub-controls associated with controlled use of administrative privileges. These are:

  • 4.1. Maintain Inventory of Administrative Accounts. 

  • 4.2. Change Default Passwords. 

  • 4.3. Ensure the Use of Dedicated Administrative Accounts. 

  • 4.4. Use Unique Passwords.

  • 4.5. Use Multi-Factor Authentication for All Administrative Access. 

  • 4.6. Use Dedicated Workstations for All Administrative Tasks. 

  • 4.7. Limit Access to Scripting Tools. 

  • 4.8. Log and Alert on Changes to Administrative Group Membership. 

  • 4.9. Log and Alert on Unsuccessful Administrative Account Login.

Thus, a PAM solution is essential to implement this control and all of its sub-controls, enabling the Information Security team to grant and revoke privileged access on a range of systems and devices. A PAM solution also allows monitoring of these accesses, as well as alerting system administrators of any non-compliance in remote sessions. An example of non-compliance would be a user attempting to access at an unauthorized time or access the admin interface of a device that is not within their purview.

Sub-control 4.1 – Maintaining Inventory of Administrative Accounts, for example, requires the organization to have full visibility over all administrative credentials and their privileges by using automated tools to inventory all privileged credentials. senhasegura, as a PAM solution, offers the Scan and Discovery resource, which enables one to scan and discover privileged credentials (such as domain and local privileged accounts) on a range of assets, such as network devices, systems, and applications, including DevOps.

Another example of sub-control that senhasegura can help implement is 4.2 – Change Default Passwords. CIS’ recommendation is that, before deploying any new assets in the environment, one must change all their default passwords to be consistent with administrative accounts. senhasegura allows the automatic rotation of all device passwords and restricts access through easily and quickly configurable, multilevel approval streams. 

Of course, the features of a PAM solution are not restricted to just these two sub-controls. In addition, this type of solution may also meet the recommendations present in other controls and their sub-controls. senhasegura offers a PAM solution that enables the implementation of numerous controls provided in the CIS’ Critical Security Controls. In addition to enabling the full implementation of privileged access management control, senhasegura also adheres to aspects linked to system inventory, configuration, monitoring, incident response, and su/sudo injection. Implementing senhasegura enables one to mitigate potential attacks against systems through privileged credentials and to ensure the trust of employees, partners, and customers, and business continuity.

← IAM vs PAM – The Difference Between Identity and Access Management and Privileged Access Management CIS Controls - PAM X 8 Secundary Controls →

$13 million growth investment drives senhasegura’s expansion in North America and the Middle East

Written by Priscilla Silva São Paulo, March 10, 2023 - senhasegura, an award-winning Privileged Access Management (PAM) solution provider that protects corporate IT environments and critical resources from cyber threats, announces a $13 million funding round from...
Read More

senhasegura wins CyberSecured 2022 award as best PAM solution in the USA

Written by Priscilla Silva SÃO PAULO, February 28 of 2023 - The 2022 edition of the CyberSecured awards, promoted by Security Today magazine, a brand of 1105 Media's Infrastructure Solutions Group, elected senhasegura as the winner in the Privileged Access Management...
Read More

How User and Entity Behavior Analytics Helps Cybersecurity

Cyberattacks are increasingly sophisticated, making traditional digital security tools insufficient to protect organizations from malicious actors. In 2015, Gartner defined a category of solutions called User and Entity Behavior Analytics (UEBA).Its big advantage is...
Read More

Best Practices for Consolidating Active Directory

This article was developed especially for you, who have questions about the best practices for consolidating Active Directory. First of all, you need to understand that directory services have the role of organizing important information for companies in a centralized...
Read More

senhasegura introduces the “Jiu-JitCISO” concept to show the power of Brazilian cybersecurity

Written by Priscilla Silva São Paulo, January 13, 2023 - "Like Jiu-Jitsu senhasegura is about self-defense. Every company must know how to protect itself and its clients". This is the aim based on the philosophy of the Japanese martial art, but made popular and...
Read More
Copyright 2023 senhasegura | All Rights Reserved | Powered by MT4 Group