Why set up browser-based privileged access?
Browser-based controls are a win-win. Taking the time to set it up once you have your platform live will create stronger security and more efficiency.
- On the security side, it will significantly reduce your organization’s attack surface by avoiding direct network connections and VPNs.
- From an efficiency point of view, you get to avoid RDP/SSH headaches, can easily grant access to those that need it, and manage access centrally from a single portal.
Plus, it supports regulatory requirements with robust session logs and recordings. Win-win-win!
How to do it?
A few things you will need to be licensed for or using for this one:
- You must be using Delinea Platform
- You must be licensed for Privileged Remote Access (PRA)
- PCS will help if you want to implement some of the finer-grained access policies noted below, but is not a requirement for browser-based access
If you fit the bill, carry on!
Once you have the Delinea Platform up and running, add your Windows, Linux, and network devices. Make sure credentials for privileged accounts you want to protect are vaulted.
Then, use role-based access and policies to define who can access what, under which circumstances. Set up approval workflows to make sure you’re doubling down on suspicious requests, and integrate with identity providers to centralize user management.
Now you're ready to activate PRA!
Best practices/considerations
For the best outcomes, regularly review and update the access policies and role-based access criteria you’ve defined. We recommend reviewing monthly or quarterly with key stakeholders.
As mentioned above, implement approval workflows for high-risk and sensitive access.
Finally, decide on and automate session monitoring and analytics. For example, integrate with SIEM or analytics, enable session monitoring or recording for RDP or SSH browser-based sessions, configure alerts for session initiation and/or set up automated session termination policies.
If your team has browser-based privileged access in place, please share in the comments other set up or maintenance best practices you’d recommend.