With shifting priorities and dynamic technology environments, IT security teams are looking for ways to cover the most ground while draining as few resources as possible. Privileged access management (PAM) continues to be a priority for many organizations as compromised privileged credentials are linked to nearly all attacks. Today, with cyber attackers targeting organizations as they invest in new tools and technologies to support remote work, many security leaders are struggling with how to prioritize new investments and how to get the most out of their existing budgets.
This is where PAM as a Service can help.
Deploying PAM as a Service can help reduce risk by locking down access to a companys sensitive data, systems and applications while optimizing resources. It also doesnt require additional IT resources to manage on-premises infrastructure, perform upgrades, patches and more. Sounds great, right?
Before going down that path, though, its important to know what qualities are essential for a PAM as a Service solution you can trust.
SaaS solutions offer opportunities for companies to gain more control over their data, helping them understand how much data they have and where exactly it resides. While it is up to the organization to manage their own policies and users on the ground floor, any company looking to secure sensitive data, systems and applications on the cloud must trust the SaaS vendors that theyre handing the keys to.
Understand the security of the service. Frequently, businesses dont investigate how exactly security vendors manage and safeguard customer data. They simply assume that everything is completely secure. The American Institute of Certified Public Accountants (AICPA) provides independent assessments known as SOC 2 to help organizations understand exactly how companies safeguard customer data and how well those controls are operating. These reports cover the principles of security, availability, confidentiality and privacy.
Most vendors who have cloud offerings hosted via major cloud providers like AWS, Azure or GCP will tout SOC 2 Type 2 compliance but verifying that the service in question has this compliance check further demonstrates a commitment to security for customers. This is an important check to make before trusting a SaaS provider to keep your data secure and private and help ensure that the service will work how and when you need it to.
Know how data is stored and secured. This is a key component of SaaS itself and should be a major consideration. Communications from the cloud to corporate assets need to be encrypted both at rest and in transit. Secure SSH tunnels from the cloud provider to customer-operated systems like Active Directory servers, SIEM servers and others ensures that assets cannot be intercepted by malicious attackers.
Keep privileged account information safe. If privileged account information is going to be transmitted between the cloud and on-premises assets, investigate whether the cloud provider protects that network traffic is undecipherable and encrypted to prevent illicit information exfiltration. The principle of least privilege should be implemented when access is needed to upgrade backend systems and integrate new features. That access is denied on default and only permitted when essential.
Choose a cloud partner you can count on. Finally, the business stability of the vendor itself will show whether you have a partner in security that will be around for the long haul and able to keep up with rapidly changing demands of todays IT world. For SaaS, this is particularly relevant as cloud-first organizations change on the fly and need solutions that are secure and as nimble as they are.
To learn more about finding a privileged access management solution you can trust, join us June 19 at 12:00 PM ET for A Service You Can Trust, the final installment in the Friday 15 webinar series.
Recent Articles By Author
*** This is a Security Bloggers Network syndicated blog from CyberArk authored by Andrew Silberman. Read the original post at: https://www.cyberark.com/blog/pam-as-a-service-its-all-a-matter-of-trust/
The rest is here:
PAM as a Service: Its All a Matter of Trust - Security Boulevard