BeyondTrust Privilege Manager 3.0 product review - Information Security Magazine

BeyondTrust Privilege Manager 3.0 product review

PRIVILEGE MANAGEMENT


BeyondTrust Privilege Manager 3.0
REVIEWED BY BRAD CAUSEY

BeyondTrust
Price: $30 per seat

The least privilege

    Requires Free Membership to View

    Login

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

security model is the de facto standard for reducing the risks of elevated user privileges. This can be a challenge in Windows environments. You don't want your end users to have general admin rights, but they may need them to run the applications required to do their jobs. There's no easy way to manage this, so companies wind up letting users have excessive privileges, leaving their desktops, user accounts and software vulnerable to attack.

BeyondTrust's Privilege Manager 3.0 solves this dilemma through a Group Policy extension that allows organizations to control permissions for selected processes and applications. BeyondTrust has also introduced a new technology, called ShatterProof process isolation, that prevents shatter attacks, a complex privilege escalation technique.


Configuration/ManagementA  
Privilege Manager adds GPO extensions that integrate with Internet Explorer and Microsoft's Group Policy Management Console, so admins can work directly through a customized Active Directory interface. The installation was very easy and fast, consisting of an MSI with few requirements, chiefly the .NET framework and AD's Group Policy Management Console. (These can be downloaded free from Microsoft's Web site.)

Once installed, the Privilege Manager settings are available by simply opening the Group Policy Object Edi-tor. It gives you a single interface to manage the custom add-ons as well as the default GPO settings, simplifying management and reducing administrative overhead.

Each managed computer requires client software to capture and manage permissions for processes and programs; it can be installed through standard software deployment or via Group Policy. The client reads the custom GPO settings and modifies the security token on programs as they launch, giving the user elevated privileges as defined by Privilege Manager rules.


Policy ControlA  
Creating policies for application privileges is simple and intuitive. Each rule allows you to identify a target process or executable name. This can be done by a number of different methods, including MSI GUID, hash, path, folder or ActiveX rules, giving you tremendous flexibility.

For each rule, you define what action will be taken, including modifying privileges and permissions for target applications. Defined privileges dictate what components of the system will be accessible when the program or process is initiated and for the duration of its run time. These rules can be configured with filters that restrict what settings apply to what group. For example, you can disable the policy for a specified application based on a wide range of criteria, such as subnet, computer name, user, security group or organizational unit. In addition, you can modify Internet Explorer behavior and ActiveX security through a custom administrative template.


EffectivenessA  
Privilege Manager provides an extremely effective framework for implementing least privilege policies. The overall concept of least privilege in an enterprise environment is plagued with difficulties. Often, developers have to get involved, code has to be changed, and massive amounts of time will be spent during implementation and dealing with unknowns. Because Privilege Manager integrates with Group Policy, it will significantly simplify the management of application privileges and permissions.


Verdict
Privilege Manager will prove invaluable for implementing and managing a least privileges program. Although long-term management of each application will be complex, it helps cut the job down to size.


Testing methodology: Clients in our AD domain consisted of several Windows 2000 and Windows XP computers with various service packs. A variety of applications were tested including Web sites with ActiveX requirements, DOS-based applications, network-based applications and locally installed programs.

This was first published in October 2007