WIXLIB

WHITE PAPERPowerBroker Privileged Account ManagementSolutions for the U.S. Federal GovernmentPowerful compliance and risk management solutions for government agencieswww.beyondtrust.com 1.800.234.9072 sales@beyondtrust.com1

Table of ContentsYour networks are under attack – from within and without . 4What does “privilege” have to do with it? . 4PowerBroker: Comprehensive privileged account management . 5The BeyondInsight IT Risk Management Platform . 7Compliance: How BeyondTrust mitigates risk across the board . 7FISMA/NIST . 7NIST SP 800-53: Security and Privacy Controls for Federal Information Systems & Organizations. 8NIST SP 800-39: Managing Information Security Risk . 8NIST SP 800-137: Continuous Monitoring. 8SANS Top 20 Critical Security Controls . 9Certifications .10You need assurance. BeyondTrust provides it. .11Sample U.S. Federal customers that trust BeyondTrust .11About BeyondTrust.12www.beyondtrust.com 1.800.234.9072 sales@beyondtrust.com2

2014 Beyond Trust. All RightsReserved.WarrantyThis document is supplied on an "as is" basis with nowarranty and no support.This document contains information,which is protected by copyright. No partof this document may be photocopied,reproduced, or translated to anotherlanguage without the prior writtenconsent of BeyondTrust.Limitations of LiabilityIn no event shall BeyondTrust be liable for errorscontained herein or for any direct, indirect, special,incidental or consequential damages (including lostprofit or lost data) whether based on warranty, contract,tort, or any other legal theory in connection with thefurnishing, performance, or use of this material.The information contained in this document is subject tochange without notice.No trademark, copyright, or patent licenses are expresslyor implicitly granted (herein) with this white paper.For the latest updates to this document,please visit:http://www.beyondtrust.comDisclaimerAll brand names and product names used in thisdocument are trademarks, registered trademarks, ortrade names of their respective holders. BeyondTrust isnot associated with any other vendors or productsmentioned in this document.www.beyondtrust.com 1.800.234.9072 sales@beyondtrust.com3

Your networks are under attack – from within and withoutThe compliance landscape for government agencies changes with almost every administration. Thereare always new requirements – and penalties – that agencies have to be able to anticipate, implement,and report on. At the same, government information networks – like their counterparts in public andprivate enterprises – are constantly vulnerable to both internal and external threats. Each of thesetypes of threats has their own unique characteristics. Internal threats may be malicious (designed to cause harm) or unintentional (the result of humanerror), exposing weaknesses in the agency’s defenses and policies. Regardless of intent, insiderscan do significant damage quickly, as they are already inside perimeter-layer security. External threats are designed to exploit vulnerabilities in networks and endpoints; they often seekto gain a foothold where they can act as an insider. Once an attacker gains administrative access, itis easy to make configuration changes that enable the installation of malicious software, and altersecurity controls for unfettered access to sensitive information.The collateral damage of such attacks is extensive, ranging from “simple” non-complianceconsequences to national security threats. Intellectual property, defense information, personnelrecords, and other classified information can easily be stolen, sold, and used against the interests ofthe U.S. government, its citizens, and its allies. The key is to enforce strict limits on what a givennetwork user is able to do in terms of accessing and utilizing network resources, and to monitor usageto quickly identify improper activity.The most effective approach to take with end users in the current environment involves restrictingaccess privileges through both policy and technology methods – allowing the least possible privilegefor every user. This is the domain of BeyondTrust’s PowerBroker privileged account management(PAM) solutions.What does “privilege” have to do with it?The least-privilege approach has gained a lot of credibility recently thanks to one notorious name:Edward Snowden. In the aftermath of Snowden leaking classified information he had access privilegesto, the NSA announced it would reduce system administrator privileges by 90%. Indeed, “Insider andprivilege misuse” was identified by the 2014 Verizon Data Breach Investigations Report as one of thenine basic patterns of activity in the past decade that have resulted in confirmed data breaches.The fact is many government users have more access than they need to perform their current jobfunctions. With a least-privilege approach, users receive permissions only to the systems, applications,and data they need based on their current role or profile in the agency. These privileges can be user,system, or role-based as well as time-based (e.g., access granted only for certain days or hours, or for aset duration of time). Administrators can increase or restrict access as needed – after all, user roles dowww.beyondtrust.com 1.800.234.9072 sales@beyondtrust.com4

change frequently and special projects often require elevatedlevels of access – but whenever possible, and as quickly aspossible, privileges should return to their least level.Still, it is important to understand that restricting privileges isonly part of the solution. All user activity while under approvedprivileges should be monitored and audited to ensureappropriate use, and to quickly identify, flag, and prevent misuse– whether malicious or unintentional. By monitoring privilegedusers with solutions such as BeyondTrust’s PowerBroker products, which enable proactive alerts and associatedreporting, you can achieve “verifiable compliance” with statedaccess policies – and gain assurance that your security solutioncan pass any audit.PowerBroker: Comprehensive privilegedaccount managementBeyondTrust’s PowerBroker suite of privileged accountmanagement (PAM) solutions provides comprehensive visibilityand control over account privileges within complex agencyenvironments. Integrated within the BeyondInsight IT RiskManagement Platform, which provides centralized managementand control, PowerBroker solutions reduce the risk and minimizethe impact of internal and external threats by giving IT andsecurity teams powerful discovery and analytics capabilities.BeyondTrust currently offers 15 distinct PowerBroker productswithin four functional categories that represent essential riskmanagement requirements:Privilege Management – Enabling fine-grain control forassigning privileges to users throughout the organization. PowerBroker Servers Enterprise PowerBroker UNIX & Linux PowerBroker for Windows Desktops & Servers PowerBroker for Virtualization & Cloud PowerBroker for DatabasesSurvey Results:“Privileges Gone Wild”In 2013, BeyondTrust surveyed 265 ITdecision makers, comprising securitymanagers and network and systemsengineers across a number of sectors,including government, financial services,manufacturing, and others. Their responsesare fairly shocking, and speak to theimportance of privileged accountmanagement.80% of respondents believe that it’s atleast somewhat likely that employees accesssensitive or confidential data out of curiosity.65% of organizations have controls tomonitor privileged access, yet 54% say theyhave the ability to circumvent these controls.43% of respondents allow sensitive data tobe stored on employee workstations/laptops.28% admitted to having retrievedinformation not relevant to their job, such asfinancial reports, salary information, and HRand personnel documents.44% of employees have unnecessaryaccess rights.76% say the risk to their organizationcaused by the insecurity of privileged userswill increase over the next few years.Active Directory Bridging – Ensuring single sign-on using the same active directory for all resources,while auditing all users who are logging in. PowerBroker Identity Services “AD Bridge”www.beyondtrust.com 1.800.234.9072 sales@beyondtrust.com5

Privileged Password Management – Establishing a “virtual safe” for shared passwords in thecompany, ensuring secure storage and retrieval. PowerBroker Password Safe Auditing & Protection – Offering unmatched reporting and analytics functionality for complianceand continuous improvement. PowerBroker Auditor for File System PowerBroker Recovery for AD PowerBroker Auditor for SQL PowerBroker Change Manager for AD PowerBroker Auditor for Exchange PowerBroker Privilege Explorer for AD PowerBroker Auditor for Active Directory (AD) PowerBroker Event Vault for WindowsFor specific information on each of the PowerBroker applications, please ww.beyondtrust.com 1.800.234.9072 sales@beyondtrust.com6

The BeyondInsight IT Risk Management PlatformAll PowerBroker PAM solutions are backed by BeyondTrust’s Retina family of vulnerabilitymanagement (VM) solutions. Both the PAM and VM solutions share a common management consoleframework called BeyondInsight. In addition to serving as a central management, analytics andreporting console for the PAM and VM product families, BeyondInsight offers additional capabilitiessuch as discovery, profiling, role-based access, and smart groups for identifying, organizing, andreporting on assets and accounts.Additionally, the BeyondInsight console enables centralized alerting, reporting, and searchfunctionality, which aggregates all privileged account information into a data warehouse and thenprovides rich analytics and reporting capabilities for mitigating risk and documenting compliance. TheBeyondInsight management console is scanner-agnostic, allowing data feeds from BeyondTrustRetina and vulnerability scanners such as Nessus , Nexpose , and QualysGuard .Compliance: How BeyondTrust mitigates risk across the boardPowerBroker and BeyondInsight provide important capabilities that support a wide range ofgovernment information security requirements. Here we have broken down some of the mostcommon and pressing federal mandates and regulations, showing the extent to which BeyondTrust’sPAM and Retina VM solutions can help agencies achieve and maintain compliance.FISMA/NISTThis section requires some familiarity with the following: The Federal Information Security Management Act of 2002 (FISMA) requires federal agencies toimplement information security solutions to protect the information and information systems thatsupport agency operations and assets. National Institute of Standards and Technology (NIST) is a non-regulatory agency of the U.S.Department of Commerce charged with advancing measurement standards. Federal Information Processing Standards (FIPS) are issued by NIST in accordance with FISMA;they are compulsory and binding for federal agencies. Special Publications (SPs) are developed and issued by NIST as recommendations and guidancedocuments. NIST Risk Management Framework (NIST RMF) is the standard for integrating informationsecurity and risk management into government agency information systems. The NIST RMFencompasses a range of activities defined by several different NIST SPs.BeyondTrust supports the requirements of three key SPs relating to the NIST RMF: SP 800-53, SP 80039, and SP 800-137.www.beyondtrust.com 1.800.234.9072 sales@beyondtrust.com7