Just-In-Time Privilege Elevation: A least-privilege solution to protect your AD-connected business

Hey, hey. My name is AJ Lindner. I'm a solutions architect at One Identity. And today, I'll be talking about just-in-time privilege elevation. To set the stage, let's use the example of a typical large technology company. And our tech company has hundreds of applications connected to Active Directory with hundreds of thousands of user accounts globally. They have a team of 20 AD administrators, each of whom has access to one or more privileged accounts with permissions like Domain Admins or Enterprise Admins. And these privileged accounts are more or less used daily, have persistent access in AD, and admins are required to change the passwords every 90 days. And this is all common practice. But these accounts are prime targets for a malicious actor seeking to own or ransom the company, because through these accounts, they could take control over every AD-connected system within the organization. And the hashes left behind with every privileged access further increases the risk of a successful attack. Breaches like this are common and frequent and can take down your business. So let's hop over to a live system and see how our large tech company could remediate this threat vector with just-in-time privilege elevation. So instead of having persistent permissions, you can see here in the Active Roles Web Interface that this Domain Admins 1 account is disabled and has no permissions other than the default Domain Users group. Now, when an administrator needs Domain Admin permissions, they can request access to this account in Safeguard for Privileged Passwords. Now, I've got this saved here as a favorite, so we'll start this request. I'll leave the default of 2 hours set, and then we'll submit. And once any approvals have been processed, I can view the account's password. Now, this password is useless for an account that's disabled with no permissions. So if I go back and refresh Active Roles, we'll see also that as part of that request, this user has been granted the SG Domain Admins group and has been enabled. Of course, that Domain Admins group is itself a member of Domain Admins. So I have access to an account with Domain Admin permissions. Now, once I'm finished with this account or the 2 hours runs out, it gets checked back into Safeguard, and three things will happen. One, the password will get changed to block me from further using it and to invalidate any residual hashes. And two, if we refresh the account back here in the Active Roles Web Interface, we'll see that it's returned back to a disabled state, and it loses its Domain Admin group membership. So we've seen how just-in-time privilege elevation protects your business by only granting privilege permissions when they are needed. Changing the password after each use ensures that any hashes an attacker comes across are useless. And even if an account is compromised, they can't do anything with it. Furthermore, you can better track who has access to what privileged resources and when they're accessing them. In the end, our large tech company is significantly less vulnerable to privileged account takeovers and can more easily meet their compliance requirements. For more information on this and other identity security solutions, visit our website at oneidentity.com.