Privileged User Access

I have been around Information Technology for 20 years and managing Privileged User Access has always been a challenge.

Different organizations handle this issue in different ways. Some choose to share the password for super user accounts (root / administrator) with folks across the IT department so work can be done without hindrance. The problem with this approach is you can’t tell who did what since the logs don’t actually reveal who the account user was. There is also the issue around password changes for these accounts which oftentimes never occurs because communication of those changes is too painful. Other organizations come at the problem from another perspective. Rather than sharing the password for the super user account, they instead, perpetually elevate certain users to a super user status. This approach is better since activity is now logged at the user level but having too many users with such highly elevated privileges is not a best practice and depending on your organizations account management process could leave the organization at risk if one of these users is terminated.

A far better approach is to grant access to super user privileges only when it’s required and for a limited period of time. Identity Automation’s ARMS Workflow system provides a way of doing exactly that. Implementation can be as unique as the organization; following are some examples.

• Create a workflow request that allows members of a certain group to be automatically granted super user status for a limited duration of time upon initiating their request. After the prescribed amount of time has elapsed, super user access will automatically be revoked.
• Create a workflow that allows members of IT to request super user access but require approval from an IT manager or Director before access is granted. After a certain amount of time, the access would be automatically revoked.
• Create a workflow that allows certain members of IT to “check out” the Administrator account so they can perform certain administrative functions. After a prescribed period of time the Administrator account password is automatically changed and the Administrator “assignment status” is reset.

The possible implementation scenarios are endless but the important thing is to have a viable solution in-place that ACTUALLY works and limits risk to the organization, is scalable and is fully auditable.