The core of the GDPR is all about data protection; specifically, securing EU citizens’ personal data. However, the GDPR does not explicitly state how to achieve this level of security. It doesn’t recommend any specific technologies to help organizations maintain compliance, making it tricky for companies to know which technical measures and controls they need. Even though complete GDPR compliance requires a variety of solutions, processes, technical controls, and measures, privileged access management is the critical aspect that is often overlooked when it comes to the GDPR.
Privileged access and ensuring data security
Most organizations that operate online, process data in some way and store personal data like customer names, email addresses, photographs, work information, conversations, media files, and a lot of other personally identifiable information. This data often goes through different infrastructural components, sometimes in transit and other times in storage. Anyone with authorized or unauthorized access to these components could lay hands on user’s personal data.
For example, a database administrator that has privileged access to perform RDBMS administration could copy, modify, or delete a user’s private data with malicious intent. As companies prepare for GDPR compliance, it becomes important for them to have a program that controls and monitors privileged access across their infrastructure. So, in order to comply with the GDPR, organizations need to define strict privileged access controls as well as meticulously track data access.
Sources of insider threats
Privileged users can put an organization at risk if they are not well managed. A privileged user is often an employee, but sometimes a third party, who has privileged access to an organization’s infrastructure. Some organizations are required to work with third parties, such as vendors, business partners, and contractors, for various reasons.
To carry out their contractual duties, these third-party partners require remote privileged access to servers, databases, and other IT applications within the organization. Even if your organization is equipped with highly secure mechanisms, you never know how third parties are handling your data. So, it is necessary to take a closer look at how privileged users affect an organization’s ability to be compliant.
Privileged access management’s role in implementing GDPR compliance
Both internal and external hackers can easily exploit vulnerabilities. The moment a hacker gains access to privileged accounts, the entire organization is vulnerable to attacks and data theft. What organizations need is a coordinated system for managing and monitoring privileged access. Privileged access management provides the basis for a streamlined internal and external audit for GDPR compliance by enforcing strict access controls. Controlling privileged access requires you to:
- Consolidate all your privileged accounts and put them in a secure, centralized vault.
- Assign strong, unique passwords and enforce periodic password rotation.
- Enforce additional controls for releasing sensitive asset passwords.
- Audit all access to privileged accounts.
- Completely eliminate hard-coded credentials in scripts and applications.
- Wherever possible, grant remote access to IT systems without revealing the credentials in plain text.
- Enforce strict access controls for third parties and closely monitor their activities.
- Establish dual controls to closely monitor privileged access sessions to highly sensitive IT assets.
- Record privileged sessions for forensic audits.
As explained above, controlling, monitoring, and managing privileged access calls for automating the entire life cycle of privileged access. However, manual approaches to privileged access management are time-consuming, error-prone, and may not be able to provide the desired level of security controls.
Password Manager Pro helps you comply with the GDPR
The GDPR’s policies for protecting personal data require organizations to demonstrate and maintain compliance. Even though the clock is ticking down to the GDPR’s implementation, it’s never too late to start your journey towards GDPR compliance. If you’re looking for assistance with this, try ManageEngine Password Manager Pro, a complete solution for controlling, monitoring, auditing, and managing the entire life cycle of privileged access. It offers three solutions in a single package: privileged account management, remote access management, and privileged session management.
Password Manager Pro fully encrypts and consolidates all your privileged accounts in one centralized vault, which is reinforced with granular access controls. It also mitigates security risks related to privileged access, as well as preempts security breaches and compliance issues before they disrupt your business.
source: https://blogs.manageengine.com/it-security/passwordmanagerpro/2017/09/05/begin-your-gdpr-journey-with-privileged-access-management.html
