WIXLIB

OverviewPassword Manager Pro offers a complete solution to control,manage, monitor and audit the entire life-cycle of privilegedaccess. In a single package it offers three solutions - privilegedaccount management, remote access management, and privilegedsession management.Password Manager Pro basically consolidates all your privilegedaccounts in a centralized vault in fully encrypted form. It enforcespassword management best practices and secures the privilegedaccounts, the keys to your kingdom. It helps mitigate securityrisks related to privileged access and preempt security breachesand compliance issues.This document lists the security risks mitigated by PasswordManager Pro.PrivilegedAccountManagementAccounts Discovery, Password Protection & ManagementPrivilegedAccountsDiscoveryPassword Manager Pro automatically discovers the IT assetsin the network (Windows, Linux, network devices & virtualmachines) and enumerates the privileged accounts associatedwith them, thus helping enterprises to quickly secure all theirprivileged identities.The discovery process mitigates the following risks: Identify unauthorized accounts or services: PasswordManager Pro lists all the privileged accounts found in yourcritical IT assets. You can easily conduct an internal auditand identify the unauthorized ones. Minimize the number of privileged accounts: Thediscovery process also helps you identify the obsoleteaccounts. You can choose to retain only the accounts thatare absolutely needed.01

Prevent unauthorized access: By randomizing passwordsof privileged accounts upon discovery, you can preventunauthorized access by present or past administrators whohad access to those passwords previously.Password Manager Pro consolidates, stores, and organizes allyour passwords in a secure, centralized repository.CentralizedPasswordVaultCentrally consolidating the privileged accounts enables you tocombat the following risks: Prevent passwords falling into the wrong hands due toinsecure storage: Network and IT administrators tend tostore sensitive credentials in text files and spreadsheets – andeven on sticky notes. These insecure storage practices makeorganizations a paradise for hackers. Password ManagerPro eliminates the vulnerabilities by establishing a secure,centralized repository of passwords. Overcome system lockout due to outdated passwords:With multiple copies of electronic files containing sensitivepasswords floating around the organization, there will beincreased instances of outdated passwords and coordinationissues, impacting operational efficiency. With PasswordManager Pro serving as the centralized repository, you caneliminate the coordination issues and system lockout issuesdue to outdated passwords.Access Provisioning and ControlsPasswordOwnershipand GranularSharingThe basic design of Password Manager Pro revolves around theconcept of password ownership and sharing. One who adds apassword to the repository becomes the owner of the passwordand the owner alone will have access to that password. If theowner wants others to view it, the password has to be shared.At any point, all users (including administrators) will only seethe passwords that are owned and shared.02

Eliminate orphan accounts: Orphaned accounts are privilegedaccounts that remain active but have no associated owner.These accounts are usually the result of an employee movingdepartments or leaving the organization. Failing to shut downor transfer ownership of these accounts can lead to accesscontrol gaps. Password Manager Pro solves this problem byallowing any departing resource owner to transfer ownershipof their resources to another authorized employee. Overcome security risks due to employee turnover: When anIT staff member having privileged access to IT resources leavesthe organization, all access to critical IT systems possessed bythe departing member should be immediately disabled. In theabsence of a password management system, it becomes toughto identify the list of passwords accessed by that user andchange all of them. Password Manager Pro allows transferringownership and randomizing passwords after the departure ofthe IT staff, thus completely eliminating security issues thatcould arise due to employee turnover. Avoid password leakage due to insecure sharing: IT stafftend to share common passwords among team members byword of mouth, email, or phone calls, which lead to passwordcompromise. Password Manager Pro offers secure, granularsharing based on job functions and helps avoid passwordexposure or compromise. Prevent unnecessary access: Password Manager Pro enforcesstrict access controls and ensures that administrators get accessonly to the passwords that they require for their job functions.For example, Windows administrators will get access only toWindows passwords and not to database passwords. This way,organizations can prevent unnecessary access. Eliminate displaying passwords in plain text: Even whilesharing passwords with others through the most securemeans, passwords may be memorized or noted down, whichmay in turn lead to unauthorized access. For ultimate security,Password Manager Pro empowers admins to provide accessto IT resources as needed, without disclosing the resourcepasswords in plain text. Users will be allowed to launch directRDP, SSH, Telnet, SQL console connections with remoteresources and automatically login to websites and applicationswithout seeing passwords.03

AD and LDAPIntegrationPassword Manager Pro integrates with corporate identity storessuch as Active Directory or LDAP for user provisioning andauthentication. It continuously synchronizes with the directoryand automatically updates the user database whenever usersare added or removed in AD. In addition, Active Directory’sauthentication capabilities can be extended to Password ManagerPro, letting users log on with their AD credentials. PasswordReleaseControl andAdvancedWorkflowOvercome user provisioning, de-provisioning issues:Password Manager Pro maintains the same user group structurein the product as in AD. Since permission to access differentpasswords can be granted based on AD groups, provisioningand deactivating password access follow changes in AD itself.This helps overcome the security issues that normally arise dueto provisioning and deactivating access.Password Manager Pro enforces an additional layer of securityfor passwords by forcing users to go through a request-releaseworkflow. Users requiring access to a password just have to raise arequest with the admin, along with a credible reason. This allowsthe admin to scrutinize access requests before approval and rejectinvalid requests. If needed, dual approvals can be configured,which necessitates two or more admins to approve a request beforethe passwords are released. Avoid insecure, permanent access when people needtemporary access: Quite often IT staff or third-partycontractors require temporary access to certain resources toperform troubleshooting operations. In such cases, passwordsare transmitted by email or telephone and forgotten thereafter.As a result, IT staff will have permanent access to thoseresources. Password Manager Pro allows administrators torelease passwords for a time-limited period at the end of whichthe password will be automatically reset and access will berevoked. Prevent exploitation of privileged access by maliciousinsiders: By enforcing dual controls on the request-releaseworkflow, malicious insiders looking to exploit authorizedprivileged access will come under scrutiny.04

PasswordReleaseControl andAdvancedWorkflow Eliminate coordination issues, conflicting changes: Whenmore than one administrator happens to access an IT resource,it could potentially lead to conflicting changes and coordinationissues. Password Manager Pro eliminates this by providingexclusive access to specific users for a specified time period. Eliminate lack of control over third-party access: Thirdparty users – including contractors, temporary staff, businesspartners and vendors who require access to the passwordsof critical IT assets – will have to raise a request for access topasswords. Administrators can grant time-limited access; andwhen the time limit expires, access will be revoked and thepassword will be reset. This process grants absolute controlover third-party access to IT resources.Remote Password ResetsPassword Manager Pro resets passwords of remote IT resourcesautomatically at periodic intervals or anytime on-demand. Itassigns strong, unique passwords to each account and supportsa wide-range of endpoints and target systems across physical,virtual, and cloud environments. Eliminate weak, static passwords; overcome crackingattempts: By randomizing passwords of remote IT resourcesat periodic intervals and assigning strong, unique passwords,Password Manager Pro helps eliminate static, unchangedpasswords across the network. This, in turn, preventsunauthorized access and cracking attempts. Eliminate static service accounts: The very powerful serviceaccounts used by the system programs to run applicationsoftware services or processes often possess high or evenexcessive privileges. Service account passwords are generallyset to “never change,” due to the difficulty in discovering alldependent services and propagating the password change.Static service accounts make the enterprise a haven for hackers.05

Password Manager Pro automatically locates service accountsby identifying the various Windows server components thatare run using domain accounts and mapping the services andscheduled tasks to respective accounts. When a service accountpassword is reset, Password Manager Pro automaticallypropagates the change across all dependent services associatedwith the account to avoid any service stoppage. Mitigate pass-the-hash attacks: Windows domain adminaccounts provide administrative privileges on all workstations,servers, and domain controllers. Only a few, trustedadministrators should use the domain administrator accounts.And, they should use the account only to log on to the domaincontroller systems that are as secure as the domain controllers.This is because Windows systems are vulnerable to pass-thehash attacks. The single sign-on functionality of Windowsallows users to enter credentials once and then never have toenter the password again. Windows actually caches the logindetails within the system in the form of password hashes. Ifan attacker manages to access a system where the domainadministrator had logged on in the past using his domainadmin credentials, the attacker could easily obtain the hashand perpetrate an unauthorized transaction.As a best practice approach, domain administrator accountsshould not be used to sign on to any system other than domaincontrollers. If there is a strong need to do so, the passwordaccess should go through a workflow for one-time usage, afterwhich it should be reset. Even if the domain admin accountsare prudently used from trusted systems, they should beperiodically changed. Password Manager Pro periodicallyrandomizes the domain administrator credentials andmitigates pass-the-hash attacks.06