新数字经济下的特权访问管理方案

1、新数字经济场景下的特权访问管理方案技术创新，变革未来黑客攻击链Aims forWindowsPrivilegesNetworkHijackingCredentialHarvesting特权访问风险面巨大特权账号无处不在账号共享，缺少责任界面应用内嵌密码难于管理改密带来挑战远程访问无法保证安全，难于追踪黑客的最爱mysql:database:populate my-db:username= production-robot, password=不同服务商的远程访问难于实现灵活访问控制D3d*9!xs3#fkd5fSDvu%34qsocv3,privileges = SELECT,INSERT,U

2、PDATE,DELETE,schemafile = /usr/share/my- db/schema/mysql.sql,DANGER!新常态下的安全趋势According to the report, phishing remains the top form of social-driven breach and “schemes are increasingly sophisticated and malicious” as remote work surges.Meanwhile, the use of stolen credentials by external actors is

3、on a meteoric rise. More than 80% of breaches tied to hacking(the number one threat action) involve the use of lost orstolen credentials or brute force.While these findings are not new or surprising, the DBIR reminds us that attackers nearly always take the path of least resistance by using this tri

4、ed-and-true approach: start with a phishing scam (96% arrive by email) targeting a users endpoint, then easily crack weak passwords or steal credentials stored on the device. Using these credentials, theattacker can move from workstation to workstation in searchof sensitive data to steal and privile

5、ged credentials (such aslocal admin rights) that enable escalation to higher-valueassets and information.https:/resources/blog/verizon-dbir-2020-credential- theft-phishing-cloud-attacks数字化转型：特权访问风险面扩大了https:/resource/the-ciso-view-protecting-privileged-access-in-devops-and-cloud-environments/CISO的两难

6、选择：特权访问安全和敏捷开发运维https:/www./resource/global-advanced- threat-landscape-2019/安全加固“左移”https:/kubernetes.io/docs/concepts/configuration/secret/#risks数字化转型背景下特权访问管理最佳实践最佳实践一-加固开发者终端移除终端中的本地管理员权限，使用零信任技术确保终端最小权限 原则，使用即时提权技术确保特权访问仅在需要时临时获取。尽可能使用多因素技术。确保开发者登录应用时的身份。控制安装应用和开源工具的权限：例如禁止安装来源不明的应用， 移除未受策略授权的应用

7、程序，企业允许安装的应用或者工具要做 到自动授予安装权限，提高开发者效率。加固终端中的工具类特权账号：例如 Chrome 浏览器中保存的账号，AWS密钥，Git凭据，WinSCP保存的凭据等等。阻止勒索软件加密。最佳实践二加固应用、服务、脚本等内嵌的密码、密钥应用、服务、脚本等内嵌大量特权账号和系统、数据库、云对接交互，潜在着巨大的 特权访问风险！避免在应用、服务、脚本内“写死”密码，使用更安全的数字保险库技术加固此类 特权账号，使用“API身份” 认证技术获取“最新”的密码。此类密码由于不能实施“多因素”技术，应使用数字保险库技术定期改密，对于密 码、密钥的调用、使用要有详尽的审计，审计日志

8、要做到不可篡改。确保定期改密对关键应用“零” 影响，例如不能中断业务、自动化流程等。关键业务应用、业务容器在调用密码、密钥时，要进行强认证确保其“身份”，防 止“非法”应用冒用密码、密钥。确保业务容器大规模并发访问时，密码、密钥的高可用和高效性。最佳实践三加固De vo p s 工具的管理控制台加固管理控制台的特权访问，操作人员或者脚本使用特权账号时具备审计功能：应用定期改密策略，自动定期改密。CI/CD工具对接交互其它系统、数据库时实时调 用最新密码；操作人员登录控制台使用双因素技术。集中化管理所有工具控制台，例如Jenkins UI、Ansible UI等，特权会话全程审计，审 计日志不可

9、篡改。开发者体验要高效，集中化管理所有控制台后，不但要保持特权会话的安全性和可审 计性，也要允许开发者自由使用其本机打开管理控制台。加固关键命令，必要时使用“双因素技术” 确保命令执行的正确性。例如对pushing commits启用“双因素”。最佳实践四加固第三方远程特权会话这些第三方远程服务商难于监控，黑客以其为跳板持续渗透到其所服务的 企业或组织：使用零信任技术确保终端最小权限原则，使用即时提权技术确保特权 访问仅在需要时临时获取。避免使用VPN拨入内网进行特权会话操作。远端特权会话避免输入密码和保存密码。内部系统避免对外发布公网访问，所有远程特权会话的操作进行监控 和审计。第三方远程服

10、务商身份管理要灵活，避免和内部身份系统混合。特权访问的权限赋予和撤销要及时，避免多余权限和过期权限。企业级全面特权访问管理加固管理控制台的特权访问Protect the tool consoleUse Privileged Session Manager and Privileged Session Manager for the Cloud to monitor and record any human or non-human interactive accessSecure the tool credentialsUse Central Policy Manager to manage

11、and rotate credentials based on policySecure the tool CLIUse On Demand Privilege Manager to Secure the tool CLI interfaceDetect unmanaged & compromised IAM users Use Privileged Threat Analytics to detect unmanaged Access Keys, and Passwords for AWS users as well as compromised privileged IAM and EC2

12、 users加固DevOps CI/CD 流水线加固业务容器的特权访问Secure Master / Cookbook / Playbook / Manifest / Application containersUse Application Access Manager to remove hard coded/ unmanaged credentials from jobsand retrieve them in a secure wayDiscover hidden hard coded credentials Use DNA to auto-discover hidden credentials in tool Playbooks, Roles, and TasksSecure the managed Nodes Use Application Access Manager to establish an identity during orchestration to use for secrets retrieval in a secure waySecure admin access to the NodesUse Privileged Session Manager to secure, con