In my previous post I wrote about intermediaries, the VPNs and jump servers between users and systems. For management there is a hidden question in that post: who actually owns those systems?<\/p>\n
Very often the answer is someone else. The VPN is run by the network team, the jump servers by the server team, the remote access tool by an outsourcing partner, and the PAM solution was bought by a project that ended two years ago. Each of them is a key part of your privileged access, and none of them is owned by the people responsible for privileged access.<\/p>\n
That is an organisational problem, not a technical one. If you don\u00b4t know who owns the intermediaries, you can\u00b4t be sure they are patched, monitored or protected at the right level. And attackers love systems that fall between the chairs.<\/p>\n
So for management: Make a list of all the intermediaries in your environment. For each one, name an owner and the security level it needs. Make sure the people protecting your admins have a say in how they are run, even if the operation is done by someone else. And include the providers\u00b4 remote access tools, which are intermediaries too.<\/p>\n
Every door into the company needs a doorkeeper with a name.<\/p>\n","protected":false},"excerpt":{"rendered":"
In my previous post I wrote about intermediaries, the VPNs and jump servers between users and systems. For management there is a hidden question in that post: who actually owns those systems? Very often the answer is someone else. The VPN is run by the network team, the jump servers by the server team, the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[38,106,41],"class_list":["post-1320","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-business","tag-intermediaries","tag-service-providers"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1320","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1320"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1320\/revisions"}],"predecessor-version":[{"id":1349,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1320\/revisions\/1349"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1320"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1320"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1320"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}