How to Build Risk-Based Privileged Access Control

TL;DR

Privileged access should be controlled through real-time, risk-based decisions instead of relying only on periodic reviews, static passwords, vaults, or detective alerts. Stronger programs reduce standing account exposure, use behavioral analysis before access is granted, and remove counterproductive requirements such as routine 90-day password changes that encourage predictable patterns.

Transcript

So, my name is Kurt Lieber. Uh, I am the CISO for Aetna, which I'm now supposed to say is a health benefits division of CVS Health. I, uh, I appreciate y'all giving me about an hour or so of your time today, um, especially in these last days before the coronavirus comes through and wipes out humanity. Um, I have been, uh, getting a kick out of, uh,... Read More

Key Insights

• Periodic access reviews are weakened by scale because reviewers may receive hundreds or thousands of access requests at once. Employees are unlikely to spend hours away from their regular responsibilities conducting a careful review, especially when the process repeats every quarter.
• Access reviews are potentially effective controls, but their periodic scheduling is the central problem. A quarterly recertification campaign concentrates too much work into a short window, encourages superficial decisions, and may provide little value beyond satisfying compliance expectations.
• Password vaults are better than having no vault, but they do not remove the privileged account. As long as that account continues to exist, it can still be compromised through multiple methods, a weakness demonstrated during Aetna's internal red-team exercises.
• Detective user behavior analytics identifies anomalies only after the relevant events have occurred. Routing those findings to a manager or security operations center introduces further delays, particularly when responsible personnel are unavailable, raising questions about the control's practical effectiveness.
• Multi-factor authentication is a binary control because successful authentication gives an attacker access without further checks. It can also face SIM or SMS session hijacking, lost or stolen tokens, compromised credential sets, and user friction during ordinary access.
• Routine 90-day password changes can weaken security by encouraging users to adopt repeatable variations. Patterns such as incrementing a number or combining a season, year, and exclamation point reduce memorability problems for users but make successive passwords easier to anticipate.
• Eight-character passwords are vulnerable to rapid exhaustive testing. Aetna used a machine costing about twenty thousand dollars to traverse the complete eight-character space, including uppercase letters, lowercase letters, numbers, and symbols, in as little as two and a half hours.
• Risk-based privileged access uses machine learning to detect anomalous behavior and supports real-time access decisions based on risk rather than static credentials. This approach addresses the timing weakness of detective controls by evaluating risk when access decisions are being made.

Questions & Answers

Q: Why are privileged credentials a major breach risk?

Privileged credentials matter because, after setting aside employee error and negligence, essentially every breach described in the session involves compromised credentials in some form, and most involve compromised privileged credentials. These accounts can provide extensive access once captured, so an advanced privileged user management program must reduce their exposure and evaluate whether conventional safeguards actually prevent compromise.

Q: Why do periodic access reviews often fail?

Periodic access reviews often fail because organizations send reviewers hundreds or even thousands of items and expect them to make careful decisions while continuing their normal jobs. Most people will devote only a few minutes, not several hours, to the task. A quarterly schedule therefore encourages superficial approval and may serve compliance expectations more than meaningful risk reduction.

Q: Are access reviews useful without a periodic schedule?

Access reviews themselves can be effective controls, but the periodic component creates the central weakness identified in the session. Concentrating large volumes of review work into quarterly campaigns overwhelms employees and separates decisions from immediate access events. The proposed direction is to replace reliance on scheduled recertification with controls that make timely decisions based on current risk.

Q: Why is a password vault insufficient for privileged access?

A password vault is preferable to having no vault, but it does not eliminate the privileged account. Because the account still exists, attackers may compromise it through methods that do not depend solely on obtaining its stored password. Aetna's internal red-team exercises demonstrated that vaulted accounts remained vulnerable, so vaulting should not be treated as a complete privileged-access solution.

Q: What is wrong with detective user behavior analytics?

Detective user behavior analytics processes account, entitlement, and activity data to find anomalies, but its findings concern events that have already happened. Sending an anomaly to a manager or security operations center adds response time, and responsible personnel may be unavailable. The technology remains powerful, but using it only as a detective control limits its ability to prevent harmful access.

Q: What are the limitations of multi-factor authentication?

Multi-factor authentication improves security compared with using no additional factor, but it still operates as a binary gateway. If attackers successfully compromise the process, they are inside and may face no further checks. The session also identifies SIM hijacking, SMS session hijacking, lost or stolen tokens, compromised credential sets, and user friction as continuing limitations.

Q: Why can changing passwords every 90 days reduce security?

Mandatory 90-day password changes create friction for users who want to complete their regular work without repeatedly memorizing new credentials. They respond by choosing predictable sequences, such as incrementing a number or combining a season, year, and exclamation point. These repeatable patterns make the control counterproductive, so stopping routine changes can improve the organization's security posture.

Q: How should risk-based privileged access control work?

Risk-based privileged access control should use machine learning to identify anomalous behavior and make real-time decisions according to risk rather than relying exclusively on static credentials. This changes behavioral analytics from a delayed investigation mechanism into input for an immediate access decision. The goal is to address risk before granting powerful access instead of alerting personnel only after activity occurs.

Summary & Key Takeaways

• Privileged credentials are central to the security problem because most breaches, excluding employee error and negligence, involve compromised credentials, and many involve privileged credentials. A mature program must therefore look beyond conventional compliance controls and examine whether each safeguard actually prevents misuse, responds quickly enough, and reduces the availability of exploitable accounts.

• Periodic access reviews are useful in principle, but their scheduled implementation often overwhelms reviewers with hundreds or thousands of requests. Employees usually cannot devote hours to careful quarterly reviews, so the exercise may become primarily a compliance activity. Password vaults likewise improve security without eliminating the underlying risk because their privileged accounts continue to exist.

• The proposed direction is a risk-based privileged access program that uses machine learning to identify anomalous behavior and make real-time access decisions. Detective analytics can arrive after harmful activity has occurred, while MFA remains a binary gateway vulnerable to several forms of compromise. Routine password changes also encourage predictable patterns and increase user friction.