Skip to content
Deutsch
Kontakt

    PAM Journey Assessment Mapping Tool

     

    Bewertung Ihres PAM-Reifegrads

    Privileged Access Management (PAM) ist entscheidend für den Schutz Ihres Unternehmens vor identitäts- und privilegienbasierten Cyberangriffen. Diese Selbstbewertung hilft Ihnen dabei, den Grad Ihrer Cyber-Resilienz zu bestimmen, indem sie Ihre Fähigkeit bewertet, 38 PAM-Sicherheitsziele zu erfüllen.

    Bitte wählen Sie für jedes der 38 Sicherheitsziele, die in der Bewertung enthalten sind, den Grad der Abdeckung, den Sie bisher erreicht haben (niedrig, mittel oder hoch). Wenn Sie das Sicherheitsziel überhaupt nicht berücksichtigt haben oder wenn es für Sie nicht zutreffend ist, antworten Sie bitte mit NA.

    Nachdem Sie die Selbsteinschätzung abgeschlossen haben, erhalten Sie umgehend einen persönlichen Bericht. Darüber hinaus wird sich ein PAM-Experte mit Ihnen in Verbindung setzen, um Ihren aktuellen Reifegrad zu überprüfen und Ihnen bei der Festlegung der nächsten Schritte zu helfen, um Ihren Erfolgspfad zu verbessern.

    Bitte beachten Sie, dass die Fragen und der abschließende Bericht in Englisch sind.

     

    Was Sie wissen sollten, bevor Sie beginnen  

    Um ein Höchstmaß an Genauigkeit und Effizienz zu erreichen, sollten Sie sich vor Beginn der Bewertung einen genauen Überblick über Ihre aktuellen PAM-Fähigkeiten verschaffen, da Sie Ihre Antworten nicht speichern und zurückkehren können. Erfassen Sie die Eingaben für jedes der 38 Sicherheitsziele und besprechen Sie sie mit Ihrem Team. Die vollständige Liste der Ziele und ein Beispiel für den Bewertungsbericht finden Sie unten.

    Step 1 of 5
    All fields are required

    To what degree do you:
    Support dual authorization for privileged operations on critical or sensitive secrets and assets. For example, requring just-in-time privileged access approval or doublelock to provide an extra layer of security for accessing secrets.
    Access Control

     
    Support just-in-time access request for elevated permissions to run privileged commands and applications on workstations and servers.
    Access Control

     
    Control application launch with local controls enforcing privilege elevation policies on Windows and Mac workstations.
    Access Control

     
    Minimize local privileged accounts on Linux and UNIX to reduce the attack surface and align with the Printiple of Least Privilege and zero standing privileges.
    Access Control

     
    Prohibit privileged access by any client that is unknown, not secured, and untrusted.
    Access Control

     
    Vault and manage the lifecycle of services/applications from provisioning to deprovisioning to rationalize the number of accounts and reduce the attack surface.
    Account Lifecycle Management

     
    Enable automatic rotation of discovered service/application account passwords. Password complexity rules can be configured. Frequent rotation and password complexity contribute to password entropy and reducing the window of opportunity for password cracking.
    Account Lifecycle Management

     
    Automate the credential management for service/application accounts and their dependencies. Ensure that when rotating a service/application account password, you don't break any other service dependent on the same account.
    Account Lifecycle Management

     
    Replace plaintext, hard-coded credentials and sensitive configuration data from source code, configuration, and script files. Replace with programmatic calls to the vault to obtain secrets and credentials. This prevents adversaries from harvesting sensitive data on the disk.
    DevOps

     
    Ability to establish policies around secret checkout and session launching. Self-service request workflows built-in to the PAM platform or via integrations with third party workflows such as ServiceNow, allow the user to request additional access. This helps align with best practices such as zero standing privileges.
    Identity Governance

     

    Step 2 of 5
    All fields are required

    To what degree do you:
    Enable creation of basic elevation policies to run privileged applications on workstations (Windows, Mac) and servers (Windows, Linux) to support least privilege.
    Identity Governance

     
    Support granular policies for privilege elevation to have tighter control over access. Enforce just-enough privilege to avoid granting excessive privileges that are not required for the task at hand.
    Identity Governance

     
    Integrate with Identity Governance and Administration tools (such as SailPoint) for attestation reporting and risk-based approvals.
    Identity Governance

     
    Integrate the vault with a SIEM tool such as Splunk Cloud or Azure Sentinel for vault activity monitoring and alerting.
    Insights & Incident Response

     
    For routine administrative activity, don't use shared (anonymous) accounts. Admins use their individual account for all access, ensuring that logged events tie back to a unique user. This streamlines incident response and audit activities.
    Insights & Incident Response

     
    Record remote sessions initiated from the vault. Sessions can be replayed and meta data searched (e.g., typed commands) to facilitate incident investigations and audits.
    Insights & Incident Response

     
    Enforce session, file, and process auditing for detailed event intel at the host operating system level. Integrate with solutions such as Splunk Cloud to forward events to a centralized SIEM.
    Insights & Incident Response

     
    Leverage audit data, machine learning, behavioral analytics, and automation to detect, track, and alert on anomalous activities.
    Insights & Incident Response

     
    Import Excel, or automatically discover and classify AD and Azure AD accounts and groups, local Windows and Linux privileged accounts, and local *NIX SSH Keys and vault them to ensure you have centralized management and control over their use.
    Inventory & Classification

     
    Continuous discovery to detect creation of new privileged accounts whether sanctioned, shadow IT, or by an adversary.
    Inventory & Classification

     

    Step 3 of 5
    All fields are required

    To what degree do you:
    Discover and classify privileged admin groups, roles, and security configuration files to ensure visiblity and simplify access (including MFA) based on their sensitivity and importance.
    Inventory & Classification

     
    Automatically discover service/application accounts across Identity and Cloud Service Providers for visibility.
    Inventory & Classification

     
    Upon discovering a new/unmanaged asset, automate the process of bringing it under centralized management, deploying PAM controls, enforcing baseline PAM policies, and vaulting local privilege accounts.
    Inventory & Classification

     
    Integrate with IT Service Management tools (such as ServiceNow) to drive access control request workflows tied to help desk tickets.
    Just-In-Time Access Request

     
    Enforce MFA policies for all employee logins to eliminate passwords and increase identity assurance.
    MFA at Depth

     
    For all admin users who log in to the vault, enforce MFA to ensure the user is the legitimate owner of the credential.
    MFA at Depth

     
    Enforce MFA when checking out a secret to ensure the user is the legitimate owner of the credential.
    MFA at Depth

     
    Enforce MFA when initiating a remote login session to a server to ensure the user is the legitimate owner of the credential.
    MFA at Depth

     
    Enforce MFA at workstations and servers for direct login and privileged command and application execution.
    MFA at Depth

     
    Enable automatic rotation of vaulted passwords. Password complexity rules can be configured. Frequent rotation and password complexity contribute to password entropy and reducing the window of opportunity for password cracking.
    Password Management

     

    Step 4 of 5
    All fields are required

    To what degree do you:
    Vault the most privileged accounts within the environment, those that can create other accounts, move laterally to access multiple systems, and that have full control within your trust fabric (AD and AAD). Enable access only in emergency situations.
    Secrets Vaulting & Management

     
    Focus on the most privileged groups within the environment, those membership grant permission to create other accounts, move laterally grant full control within your trust fabric (AD and AAD).
    Secrets Vaulting & Management

     
    Manage admin groups, roles, and security configuration files that might grant privileges across all assets.
    Secrets Vaulting & Management

     
    Enable use of a bastion/jump host to proxy connections to servers in private networks that don't expose public IP addresses. Target servers are configured to only permit inbound sessions from the trusted jump hosts.
    Secure PAM

     
    For remote sessions, obtain necessary credentials from the vault without exposing to the user.
    Secure Remote Access

     
    Leverage vaulted credentials to automatically launch login sessions to targets other than servers and websites. Extend credential and session security to any target that has a suitable API such as PowerShell, PuTTY, SQL Server, and Notepad.
    Secure Remote Access

     
    Enable browser-based remote server sessions to Windows, Linux, and UNIX servers. Ideal for vendors and other remote users, this reduces the risks associated with VPN-based remote access, increases user productivity, and reduces helpdesk calls.
    Secure Remote Access

     
    Expand remote access beyond remote employees to 3rd-party vendors and contractors. Ensure a stricter degree of security leveraging VPN-less remote access since you have less control over these users.
    Secure Remote Access

     

    Step 5 of 5
    All fields are required

    Enter your contact info below and submit to see your finished report.

    Delinea needs the contact information you provide to us to contact you about our products and services. If you have subscribed, you may unsubscribe from these communications at any time. For information on how to unsubscribe, as well as our privacy practices and commitment to protecting your privacy, please review our Privacy Policy.
    1 2 3 4 5