BR +55 11 3069 3925 | USA +1 469 620 7643

  • HELP ME
  • BLOG
  • Português
  • BR +55 11 3069 3925 | USA +1 469 620 7643
  • Português
logo senhasegura
  • SOLUTIONS
  • PRODUCTS
  • SERVICES AND SUPPORT
  • PARTNERS
  • COMPANY
  • CONTACT
  • DEMO

Compliance

and Audit

Audit

PCI DSS

SOX

ISO 27001

HIPAA

NIST

GDPR

ISA 62443 |

Industry 4.0

Security and

Risk Management

Privilege Abuse

Third Party Access

Privileged Access Recording

Insider Threat

Data Theft Prevention

Hardcoded Passwords

Password Reset

Solutions

By Industry

Energy and Utilities

Financial

Government

Health Care

Legal

Telecoms

Retail

senhasegura

Testimonials

See Testimonials

360º Privilege Platform

Account and

Session

PAM Core

Domum

Remote Access

PAM SaaS

GO Endpoint

Manager

GO Endpoint

Manager Windows

GO Endpoint

Manager Linux

DevOps Secret

Manager

DevOps Secret

Manager

Multi

Cloud

Cloud IAM

Certificate

Manager

Certificate

Manager

Privileged

Infrastructure

PAM Crypto Appliance

PAM Virtual Crypto Appliance

PAM Load Balancer

Delivery : On Cloud (SaaS) | On-premises | Hybrid

Services

and Support

Documentation

Solution Center

Suggestions

Training and Certification

Deployment and Consulting

PAMaturity

PAM 360º

Support Policy

senhasegura

Resources

Rich Materials

Customer Cases

Webinars Calendar

senhasegura Stickers

 BLOG

CONTENT

Is your company really prepared for a cyber attack?

The Pillars of Information Security

7 signs that your company needs to improve the security of sensitive data

See more articles about cybersecurity

Technical

Information

How it works

Product Archicture

Integration

Security

High availability and contingency

Privileged Auditing (Configuration)

Privileged Change Audit

Features and

Functionalities

ITSM Integration

Behavior Analysis

Threat Analysis

Privileged Information Protection

Scan Discovery

Task Management

Session Management (PSM)

Application Identity (AAPM)

SSH Key Management

Affinity Partner

Program

About the Program

Become a Partner

MSSP Affinity Partner Program

Security Alliance Program

Academy | E-learning for Certification

Affinity

Portal

Portal dedicated only for Partners to find commercial, marketing supporting materials and certification program of senhasegura.

Access Partner Portal

Opportunity

Booking

For our Commercial Team to support your sale more effectively, request your opportunity booking here.

Opportunity Booking Request

Find a

Partner

We work together to offer a better solution for your company.

Check all senhasegura partners

About

Company

About us

Why senhasegura

Press

Events

Career

Presence in the World

Terms of Use

End User License Agreement (EULA)

Privacy and Cookie Policy

Certification at senhasegura

senhasegura

Testimonials

See Testimonials

Latest

Reports

Gartner PAM Magic Quadrant 2021 Report

KuppingerCole Leadership Compass: PAM 2021

GigaOm Radar Report 2021

Gartner PAM Magic Quadrant 2020

Gartner Critical Capabilities for PAM 2020

Information Services Group, Inc. (ISG)

KuppingerCole Leadership Compass: PAM 2020

Contact our team

Request a Demonstration

CIS Controls – PAM x 20 Controls Focused on PAM

by senhasegura Blog Team | Sep 26, 2019 | BLOG

The Michaelis Dictionary defines risk as the likelihood of damage in a given project or thing due to an uncertain event. This definition applies to anything that may expose people and organizations to risk, including Information Security. In this specific context, we can state that cyber-security risk is the likelihood of this damage to occur as a result of the use of interconnected systems. With this in mind, it is possible for those responsible for Information Security to be clear about the actions to be taken to mitigate these risks, that is, to prevent organizations from suffering such damages.

To assist in defining strategies for cyberattack protection, market organizations have created a set of policies and procedures, which is documented for theoretical knowledge, and also practical implementation procedures. Some of these frameworks may, in some cases, be designed for a specific industry, and are designed to reduce unknown vulnerabilities and configuration errors in the organizational environment. To summarize, these standards introduce models to allow organizations to understand their security approach and know how to improve it. And as they have been tested in different situations and industries, one can vouch for their confidence and effectiveness.

The industry’s leading cyber-security risk management frameworks, regulations, and standards are the ISO 27000 standards, the NIST’s Cyber-Security Framework, the PCI DSS standard, and the Center for Internet Security’s (CIS) Critical Security Controls.

CIS is a nonprofit organization that aims to leverage the power of a global IT community to secure public and private organizations against cyber threats. Thus, CIS has defined a set of critical security controls, based on the industry’s best practices, that organizations must implement in their environment to ensure an effective cyber-security strategy. These critical controls are divided into three distinct sets: basic, foundation, and organizational, totaling 20 controls that address basically all aspects of cyber-security. These are:

Even though CIS’ controls address numerous aspects of Information Security, some of them are directly related to Privileged Access Management (PAM). From the 20 controls proposed by CIS, one specifically addresses PAM, while the other 19 are influenced or effectively require the concepts related to PAM.

Privileged Access Management refers to a set of technologies and practices that monitors and manages privileged access (also called administrative access) to critical systems. With a privileged credential, a user can, for example, modify system settings, user accounts, and access critical data.

Thus, given their level of access and control over the systems that manage information or processes, a privileged user exposes the organization to potential business risks. Whether through an attack, privilege abuse, or human error, a privileged user can be an attack vector for a potential security incident.

Control number 4 (controlled use of administrative privileges) directly addresses aspects of PAM. In order to understand how a PAM solution can fully address this control, let’s present the CIS-provided sub-controls associated with controlled use of administrative privileges. These are:

  • 4.1. Maintain Inventory of Administrative Accounts. 

  • 4.2. Change Default Passwords. 

  • 4.3. Ensure the Use of Dedicated Administrative Accounts. 

  • 4.4. Use Unique Passwords.

  • 4.5. Use Multi-Factor Authentication for All Administrative Access. 

  • 4.6. Use Dedicated Workstations for All Administrative Tasks. 

  • 4.7. Limit Access to Scripting Tools. 

  • 4.8. Log and Alert on Changes to Administrative Group Membership. 

  • 4.9. Log and Alert on Unsuccessful Administrative Account Login.

Thus, a PAM solution is essential to implement this control and all of its sub-controls, enabling the Information Security team to grant and revoke privileged access on a range of systems and devices. A PAM solution also allows monitoring of these accesses, as well as alerting system administrators of any non-compliance in remote sessions. An example of non-compliance would be a user attempting to access at an unauthorized time or access the admin interface of a device that is not within their purview.

Sub-control 4.1 – Maintaining Inventory of Administrative Accounts, for example, requires the organization to have full visibility over all administrative credentials and their privileges by using automated tools to inventory all privileged credentials. senhasegura, as a PAM solution, offers the Scan and Discovery resource, which enables one to scan and discover privileged credentials (such as domain and local privileged accounts) on a range of assets, such as network devices, systems, and applications, including DevOps.

Another example of sub-control that senhasegura can help implement is 4.2 – Change Default Passwords. CIS’ recommendation is that, before deploying any new assets in the environment, one must change all their default passwords to be consistent with administrative accounts. senhasegura allows the automatic rotation of all device passwords and restricts access through easily and quickly configurable, multilevel approval streams. 

Of course, the features of a PAM solution are not restricted to just these two sub-controls. In addition, this type of solution may also meet the recommendations present in other controls and their sub-controls. senhasegura offers a PAM solution that enables the implementation of numerous controls provided in the CIS’ Critical Security Controls. In addition to enabling the full implementation of privileged access management control, senhasegura also adheres to aspects linked to system inventory, configuration, monitoring, incident response, and su/sudo injection. Implementing senhasegura enables one to mitigate potential attacks against systems through privileged credentials and to ensure the trust of employees, partners, and customers, and business continuity.

← IAM vs PAM – The Difference Between Identity and Access Management and Privileged Access Management CIS Controls - PAM X 8 Secundary Controls →

Achieving Sarbanes-Oxley (SOX) Compliance Using Cybersecurity Controls

The Sarbanes-Oxley Act (SOX) is primarily associated with business transparency and the use of accounting and financial controls to protect investors from fraudulent financial reporting. However, it is always important to remember the ever-increasing pivotal role...
Read More

Privileged Access Management (PAM): A Complete Guide

In 2021, there was a 50% increase in the number of attacks on corporate networks compared to the previous year. This is pointed out by Check Point Research (CPR), Check Point's Threat Intelligence division. And many of these attacks involve exploiting this type of...
Read More

What Is the Risk of Hardcoded Passwords For Your Business?

Today's organizations rely on numerous business applications, web services, and custom software solutions to meet business communications and other transaction requirements. Typically, multiple applications frequently require access to databases and other applications...
Read More

Greatest Cyberattacks On U.S. Companies In The Last 10 Years

Virtually every day we see news of data breaches, which affect organizations of all types and sizes. From startups to global companies, they are subject to cyber attacks aimed at stealing (or even destroying) data. After all, the question is not “if”, but “when” an...
Read More

Best Practices for Data Theft Prevention

It is important to emphasize that, with the digital transformation and the increase in the use of digital media identified in recent years, there has also been a spike in the practice of cybercrime, that is, those crimes that occur through virtual means. These crimes...
Read More

Share This!

Copyright 2022 senhasegura | All Rights Reserved | Powered by MT4 Group
By continuing to use this website, you consent to our use of cookies. For more information, please read our cookie policy.AcceptRead Our Privacy and Cookie Statement
Manage consent

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
CookieDurationDescription
cookielawinfo-checkbox-analytics11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional11 monthsThe cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy11 monthsThe cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytics
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
Others
Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet.
SAVE & ACCEPT
Copy link
CopyCopied
Powered by Social Snap