Read More>> 
The Context
The privileged access attack vector is very large, and it is extremely crucial for risk leaders to architect the privileged access management (PAM) in such a way that ensures minimum chances of exploitation.
Privileged Session Monitoring, one of the critical functionalities in privileged access management, manages privileged user sessions. It provides tight controls for any privileged users or a third-party requiring access to critical systems.
Isolation, monitoring, and recording are the key purposes of session monitoring and if any organization’s PAM initiative does not include a robust session monitoring capability, it would lead to poor PAM implementation and result in vulnerable cyber defense.
Let us consider an example. Banks, government organizations and hospitals use CCTVs both inside and outside their premises for identification of any suspicious activity and catch the culprits. In fact, we do use CCTVs in our sensitive areas of residence as well for safety reasons. With the help of the footage that is stored in the SD Card or in the in-built memory, the security administrators can identify who has done what, when and how.
The functionality of Session Monitoring in Privileged Access Management is the “CCTV” of privileged sessions in a vast and distributed IT environment.
In a modern IT infrastructure, there are dynamic number of privileged users who are continuously accessing critical applications to perform multiple privileged tasks. Hence, it is impossible for the IT administrator to keep an eye on individual users who is doing what.
Session monitoring helps administrators to detect, identify and mitigate suspicious activities done by privileged users to ensure data security and data privacy. It can also be considered a step forward to ease the life of both PAM users and IT administrators since it captures every session and helps to review video logs at any time for audit.
In this blog let us discuss how ARCON’s Session Monitoring capabilities enable administrators to address the following use cases seamlessly.
Use Case 1: Session Orchestrator
The IT administrators desire detailed reports of every session for audit and regulatory compliance purposes. The more detailed the report is, the more lucid and authentic it is and compliable with IT standards. If there is no provision to configure different fields in every privileged session, then the detailed and customized reports cannot be generated at any point of time. These details include username, IP address, API URL, data folder path and more.
With the help of ARCON’s Session Orchestrator configuration, the user can easily and efficiently configure different details pertaining to the session. It includes IP addresses of the users, Transmission Control Protocol (TCP) Port Number, WebSocket Secure Connection (WSS) Port Number, Application Programming Interface (API) details, Working API URL, Data Storage Folder Path, Active/ Inactive status etc. As a result, the administrators can view or download complete details of the session logs formed after every session. Hence, going by the literal meaning, this functionality is known as ‘Session Orchestrator.’
Use Case 2: Freeze/ Unfreeze Sessions
Being an administrator, what will you do if you find anything suspicious happening in the enterprise network? The obvious answer is to cease the activity with immediate effect. However, if the PAM solution does not have any such provision to stop the session, then the administrator will have to wait for the report to be generated after the session to address the malicious act. This might inflict more damage than it is supposed to be if there was any provision to stop the task by a super admin anytime.
ARCON | PAM’s Session Monitoring offers options to freeze/ unfreeze privilege sessions if anything unnatural is found. During live streaming of the user activities, the IT administrators monitor real-time activities and can freeze the session if anything suspicious is detected. At the same time, they can unfreeze the session if required and the user can resume the task in no time. Moreover, in case of serious anomaly, the admin can “Lock” the session (and the user) for an indefinite period till further notice. This mechanism helps to mitigate malicious insiders in real-time.
Use Case 3: Session Logs
When privileged users access any critical system at any point of time for a critical task, it is highly imperative for the administrators to have session logs. These logs are records of those activities that occur during a privileged access session. They can be used to track user activity, identify potential security threats, and troubleshoot problems.
ARCON PAM supports the following types of session logs:
- Service access logs: These logs record information about services accessed during the session.
- Command logs: These logs record the commands that were executed during the session.
- Process logs: These logs record the processes that were started or stopped during the session.
- Metadata logs: These logs record additional information about the session, such as the user’s IP address and the time and date of the session.
- User activity logs: These logs record a detailed account of the user’s activity during the session.
The type of session logs that are generated depends on the configuration of ARCON | PAM. For example, if the administrator has configured ARCON | PAM to record user activity logs, then all the users’ actions will be recorded in the logs. This is beneficial for the IT security administrators because by tracking user activity, they can identify potential threats and troubleshoot problems instantly.
Conclusion
The robustness of ARCON | PAM’s session monitoring capabilities helps IT admins to ward off potential insider and third-party threats and helps to build a strong cyber defense posture.
