Establishing controls for privileged access continues to be a focus of attention for organisations and auditors.

According to analyst firm Gartner, a quarter of organisations will review privileged activity and reduce data leakage incidents by 33% by 2018.

Less than 5% of organisations were tracking and reviewing privileged activity in 2015.

“The remainder is, at best, controlling access and logging when, where and by whom privileged access takes place — but not what is actually done,” said Felix Gaehtgens, research director at Gartner. “Unless organisations track and review privileged activity, they risk being blindsided by insider threats, malicious users or errors that cause significant outages."

>See also: Privileged identities are at the core of today’s cyber attacks

Prevention of both breaches and insider attacks has become a major driver for the adoption of privileged access management (PAM) solutions, in addition to compliance and operational efficiency.

PAM is a set of technologies designed to help organisations address the inherent problems related to privileged accounts.

“IT organisations are under increasing business and regulatory pressure to control access to these accounts, which can be administrative accounts, system accounts or operations accounts," Gaehtgens added.

Gartner recommends five ways that IT operations and security leaders can ensure effective and risk-aware privileged access management.

1. Inventory all the accounts with privileged access and assign ownership

All privileged accounts in your IT environment that enjoy permission levels beyond those of a standard user should be accounted for.

It is a security best practice to frequently scan your infrastructure to discover any new accounts introduced with excess privileges.

"This becomes even more important for dynamic environments that change rapidly, such as those using virtualisation on a large scale, or hybrid IT environments that include cloud infrastructure," said Gaehtgens.

“Organisations should start by using free autodiscovery tools offered by some PAM vendors to enable automated discovery of unmanaged systems and accounts across the range of infrastructure – but even those autodiscovery tools will not find everything.”

2. Shared-account passwords must not be shared

The golden rule is that shared-account passwords must not themselves be shared. Sharing passwords, even among approved users, severely erodes personal accountability – this is a security best practice and demanded by regulatory compliance. It also makes it less likely that passwords will leak to others.

3. Minimise the number of personal and shared privileged accounts

Eliminate, or at least drastically reduce, the number of users with (permanent, full) superuser privileges to the minimum that is consistent with operational and business needs.

Migrating to shared privileged accounts is a recommended practice – however, this requires appropriate tools. Managing the risks and control issues that arise from the use of such accounts is inefficient and complicated without a shared account password management tool.

4. Establish processes and controls for managing the use of shared accounts

Establish processes and controls for managing shared accounts and their passwords. While it is possible to use manual processes to manage privileged access, it is too cumbersome and virtually impossible to enforce such practices without specialised PAM tools.

IT operations and security leaders need to implement PAM tools to automate processes, enforce controls and provide an audit trail for individual accountability.

>See also: Insider hacks vs. outsider threats: spending budget in the wrong places

These tools are mature, and provide efficient and effective password management for shared superuser (and other) accounts in a robust, controlled and accountable manner, enabling any organisation to meet regulatory compliance requirements for restricted access and individual accountability.

5. Use privilege elevation for users with regular (non-privileged) access

Administrators will typically have personal, non-privileged accounts that they use for their day-to-day work, such as reading email, browsing the web, accessing corporate applications, creating and reviewing information, and so on.

“Never assign superuser privileges to these accounts, because these might exacerbate accidental actions or malware that can cause drastic consequences when used in a privileged environment," said Gaehtgens. "Instead, use privilege elevation to allow temporary execution of privileged commands."