How MFA and PAM Work Together
Corporate network environments are typically large, with many points of access that can potentially be exploited to gain unauthorized entrance to the network, and to the resources and data within that network. In attempting to lock down systems against unauthorized access, cybersecurity teams will often use a “defense in depth” strategy whereby the system as a whole is protected by using multiple layers of defense that seek to ensure the protection individually of each of its components.
Two such layers that are commonly employed are multi-factor authentication (MFA) and privileged access management (PAM). To illustrate the defense-in-depth paradigm, it’s helpful to have an understanding of what MFA and PAM are, and how they work together to provide a layered defense against unauthorized system access and exploitation.
A strong MFA solution in front of PAM helps to ensure that users are who they say they are before they ever reach the point of access.
Breaking Down MFA
Everyone is familiar with the typical username-and-password system of gaining access to anything from email and website accounts to network resources like servers. Such a process, standing on its own, presents a single factor of authentication: If you know the login, you have access to the resources firewalled for you behind that login. The trouble, of course, is that by nature, single-factor authentication isn’t terribly secure, putting a single obstacle between you and the resource. Passwords are stolen from databases, or provided to a phishing scam made to look just like the legitimate site the user intended to visit, or are weak and easily cracked by a hacker with the right tools.
Multi-factor authentication provides a solution to this problem by requiring that users authenticate themselves with more than a single factor. That is, along with something a user knows, like a password, an MFA scheme will also require that the user have something that is distinctly theirs, unique to them. With a password plus a unique identifier, the system receives two layers – or factors – of proof that you are who you say you are.
When a user attempts to log in to a system and is sent a text to their phone with an authorization code, that’s MFA at work: It’s making use of the fact that even though a user’s password may have been hacked, it’s unlikely that the hacker would also have the user’s phone. Short of Mission Impossible-style antics, it’s extremely unlikely that a hacker in possession of a password will also have the user’s fingerprint, for example.
Privileged Access Management: PAM
Privileged access management, on the other hand, concerns itself with appropriately protecting privileged resources within a network. PAM is necessitated by the fact that even (or especially) within a given network, not all users are created equal – and each should only be granted the least privileges required to accomplish their appropriate tasks. That is, certain users will be DBAs, for example, and require privileged access to database servers in order to do their jobs while at the same time being restricted from seeing other network elements which they do not need in their DBA role; and likewise for network engineers, who will need privileged access to routers and firewalls but not access to database servers.
Thus, PAM solutions need to be aware of not only who a user is, but also to which resources they should be granted privileged access. To enhance security even further, strong PAM solutions tend to have their own layers of security capabilities. That is, they will have the ability to limit user access not only by role, but also by other factors such as time and location, ensuring that even a user who has been authenticated only sees the specific resource to be accessed, and only when appropriate. As a quick example, a given user may be granted privileged access to a server to do an update because they have the role of server admin; but the PAM administrators might also limit that privileged access, for business reasons or simply as a security practice, to a two-hour window starting at midnight, for example. Outside of that time frame, even with the login credentials, the user won’t be able to access the server for good or malicious reasons.
How PAM and MFA Work Together
In a discussion of privileged access management, though, there’s an important point to be made. If a user has successfully authenticated to the system, the PAM system will provide the user the privileged access they have been granted. Of course, that’s entirely appropriate, when the user is who they say they are – but potentially disastrous when a privileged user within the system is not who they claim to be.
Strong PAM solutions have safeguards to protect against this very situation. Session management tools, for example, will alert the security team (or automatically kill the session) when the activity undertaken by a privileged user is outside of defined parameters, such as a purported database administrator who suddenly begins to rapidly execute a large number of queries against multiple databases.
But what of the case where a hacker has stolen a DBA’s credentials, gained entrance to the system, and then undertakes activity which does not raise alarms, such as running an occasional query as the legitimate DBA might do?
This is the kind of situation prevented by MFA and PAM solutions working together to truly provide a layered defense in depth. Where strong PAM solutions excel at providing only the appropriate access to privileged users, a strong MFA capability in front of PAM helps to ensure that users are who they say are before they ever reach the point at which privileges must be determined and granted.
It’s a layered strategy that truly helps security teams and administrators create a defense-in-depth – and in today’s networked environments that are subjected to constant probing and hacking attempts, it’s a solid way to increase a firm’s cybersecurity.
For more information, do not hesitate to contact our WALLIX expert teams. They would be happy to answer your questions!
