Protecting the keys to your kingdom against cyber-attacks and insider threats

Short Summary

Privileged Account Management (PAM) is positioned as a foundational control for modern organizations because both insiders abusing entitlements and external attackers hijacking elevated accounts can cause disproportionate damage—ranging from data and intellectual property theft to disrupting critical IT infrastructure. As connectivity expands through smart manufacturing, cloud services, and more connected users and devices, the number of targets and attack surfaces grows, making it unrealistic to assume any connected system will avoid being targeted. Attackers increasingly use automated techniques and discovery tools such as Shodan, and smaller organizations can be victimized directly (e.g., ransomware) or used as stepping stones to reach larger targets.

PAM must be broader than “root” or “Windows Admin” management. It spans shared and individual privileged accounts across endpoints, servers, applications, network devices, hypervisors, and cloud environments, including widely overlooked built-in, local system, service, and functional accounts that are often both shared and highly privileged. Cloud and Managed Service Provider (MSP) models intensify the problem because administrative controls are frequently shared, roles may be insufficiently granular, and provider-side accounts may be used by multiple individuals. Since perimeter defenses cannot prevent damage once an attacker is inside (including insiders by definition), organizations need “core” protections that restrict, monitor, and detect abuse of privileged access.

A comprehensive approach follows a Privilege Account Management Cycle: understand scope, identify accounts, protect and restrict access, monitor use, detect anomalies, respond quickly, and continuously improve. Solutions should integrate shared password management, session monitoring/recording/interception, behavioral analytics, application credential handling, and endpoint privilege controls. Thycotic’s Secret Server is presented as a rapid-to-deploy, enterprise-ready platform with broad integrations, APIs/PowerShell extensibility, and added analytics and endpoint capabilities, supported by an action plan combining tools with guidelines, organizational ownership, skilled people, and integrations into broader security systems.

Interesting Facts

• Internal and external attackers both target privileged accounts to execute advanced attacks and maximize damage.
• Automated attacks are continuously run to place malware or identify entry points for more advanced scenarios.
• Shodan is used as a “computer search engine” to find attack targets.
• Several prominent information leakage incidents cited—Swiss bank tax-fraud-related data theft, Wikileaks, and Snowden—were insider-driven.
• Many cloud services commonly rely on shared accounts for privileged administrative activities due to limited administrative role concepts.
• MSPs often perform privileged actions using shared accounts or individual accounts that are used by multiple users on the provider side.
• Advanced attacks have been known to run for months or years before detection.
• Session management can include monitoring, recording, and interception of privileged sessions.
• Thycotic is described as a US-based vendor with offices in London and Sydney and a global partner ecosystem.
• Thycotic’s Privilege Ready Program includes more than 30 vendor integrations spanning Identity Governance, SIEM, security intelligence platforms, and adaptive authentication.

Notable Quotes

• “Privilege Account Management is not only about shared accounts”
• “Don’t ignore the insider”
• “It’s not only about the root account”
• “The attackers are already in”
• “External attackers try hijacking privileged accounts”
• “Privilege Management starts with Shared Account Password Management, but goes well beyond”
• “Thycotic has lean and rapid-to-deploy solutions in its DNA”
• “Our IT administrators were able to get up to speed with Secret Server within minutes and our control over data security was improved immediately. By adopting a tool that manages our sensitive credentials for us, we no longer face the inefficiencies that can plague an organization as big as ours.”
• “We can't say enough about the Secret Server product and its ability to integrate with just about anything. With the use of APIs, scripting and automating is much, much easier now!”
• “Auditors identifying the lack of Privilege Account Management immediately alarmed our C-level”