The hidden owners of your security
Jun 26th, 2022 by Jesper Kråkhede
In my previous post I wrote about intermediaries, the VPNs and jump servers between users and systems. For management there is a hidden question in that post: who actually owns those systems?
Very often the answer is someone else. The VPN is run by the network team, the jump servers by the server team, the remote access tool by an outsourcing partner, and the PAM solution was bought by a project that ended two years ago. Each of them is a key part of your privileged access, and none of them is owned by the people responsible for privileged access.
That is an organisational problem, not a technical one. If you don´t know who owns the intermediaries, you can´t be sure they are patched, monitored or protected at the right level. And attackers love systems that fall between the chairs.
So for management: Make a list of all the intermediaries in your environment. For each one, name an owner and the security level it needs. Make sure the people protecting your admins have a say in how they are run, even if the operation is done by someone else. And include the providers´ remote access tools, which are intermediaries too.
Every door into the company needs a doorkeeper with a name.