What are the best ways to manage operational systems access?

In my POV, Roles should be defined custom as much as possible instead of using defined roles with the thumb rule of least privilege, importantly followed for all the environments and not just the production. In addition to above, there should be strong on-boarding and off-boarding processes to ensure timely grants and revocation. Also there should be proper diligence to evaluate usage of human and service accounts.

RBAC - Role based Access control is sometimes not as easy as it sounds. In several organisations, the same person may be given multiple levels off access across functional modules and at times this necessitates privileges too. Managing this goes beyond, password policies, authentication, and dilutes least privilege access principles. In any enterprise , real damage happens when a privileged ID is compromised. There is a need to work with HR / Functional Heads to understand and practice this with better rigour.

Defining a clear roles and permissions will: - Limit the number of super users and minimizes operational risks. - Improve control over operational tasks.

Keep the OS updated with the latest patches, security fixes, and feature enhancements to ensure stability and security. Measures. Employ firewalls, antivirus software, and regular security audits to safeguard against threats. Implement a robust backup strategy to prevent data loss in case of system failures or cyberattacks.Monitoring and Maintenance. Regularly monitor system performance, hardware health, and resource usage. Conduct routine maintenance tasks like disk cleanup, defragmentation, and system optimization.User Access Control Enforce proper user access control by setting permissions and restrictions to ensure data integrity and prevent unauthorized access.Documentation and Procedures

By establishing a collaborative and systematic approach between HR and IT, organizations can ensure that roles and permissions are clearly defined, regularly reviewed, and aligned with business needs and security requirements. This collaboration helps maintain a secure and efficient digital environment for the organization.

Zero-trust should be the standard for all access control methods due to increasing cyber threats from organized crime and adversary state-backed bad actors.

Empower end users with strong Security. Work smarter and cut costs. Trust management to make smart choices. Find ways to optimize centralized apps

Frequently, passwords are identified as the vulnerable point in the security chain, often due to the common practice of individuals reusing the same password with slight modifications, such as altering a character or two. Exploring alternatives to traditional passwords, technologies like fingerprint and/or facial recognition, and iris scans are gaining popularity, enhancing both security and user convenience. MFA combined with other verification methods, such as one-time codes or physical tokens, provides an additional layer of protection. Considering options like FIDO2 (Fast Identity Online) allows for the storage of biometrics or security keys on trusted devices, mitigating the risks associated with password leaks and phishing attacks.

- Strong Authentication with Zero-Trust principle. - A comprehensive patching across all devices and systems to prevent session hijacking. - Train users to counter social engineering methods.

Yes, of course Zero Trust should be implemented, but the focus should be more in authorization then authentication, currently all cloud providers offer very strong authentication systems and most of them force the use of MFA authentication, so in my opinion the focus should be more on authorization to keep your environment secure.

In my experience centralized tooling is paramount. Speaking from a FinOps lens, when operating in multiple clouds it’s essential to roll the data into one tool and manage access via single sign on. Trying to harness data via multiple portals slows down real time decision making. Ideally you want to link your centralized tools together for automation and digitalization capabilities to enable good benchmarking and KPIs, how good is good or how bad is bad.

In my experience, organizations gain flexibility to control access to corporate platforms with appropriate policies, by protecting access to data on any device, time and place. It offers greater visibility into users and company activities, which results in greater control over access and helps reduce the risk of data breaches with unauthorized access.p

Access tools and automation will: - Govern access and permissions. - Simplify user access process. - Logging users access requests & approvals.

With OS level permissions there the admin, and there's everybody else. Sometimes, like in the role of a developer for example, local admin is required. But more often than not, the average end user will never need more than normal user access. That being said there's the actual administration of the OS which should be automated as much as possible. From the software deployment to the OS patching, the less human intervention the less risk you have for a compromise or accidental system failure. Tools to manage access should be used for PIM as well to reduce the administration manual effort so your engineers can focus on the funner things in IT.

One example could be using CyberArk Privileged Access Management platform where the user shall never need to know the credentials/or even update them. Credentials should be managed automatically behind the scene. User should be authorized based on an ITSM Incident/Change. User should be allowed to access such Privileged Access Management tool with MFA. Then, based on the nature of the target system, additional approvals should be granted before the user can invoke any operational GUI/RDP/ssh etc.

Keeping detailed records of system activity is vital for security and compliance. This helps identify suspicious patterns and respond to security incidents. SIEM (Security Information and Event Management) software such as Splunk or Azure Sentinel can be used to centralize and analyze logs from different systems

Overall, maintaining robust audit trails and logs within airline operations systems is crucial for ensuring compliance, detecting and responding to security incidents, improving operations, maintaining accountability, managing risks, and supporting legal and investigative needs.

Audit logs should answer the Who, What, Where, When, and How when it comes to an access event. What will also help audit logs be useful is having a policy of using named accounts only (instead of generic departmental accounts) with all interactive or manual logons. From an auditing standpoint, the less interactive logons there are with generic, shared accounts, the better in terms of accountability and visibility into logon activity.

Based on my experience, effective management of operational systems access involves maintaining comprehensive audit trails and logs. Regularly monitoring and documenting user activities provides visibility into who accessed what information and when. This not only aids in detecting and responding to security incidents but also ensures compliance with regulatory requirements. Implementing robust logging mechanisms helps in forensic analysis and troubleshooting, contributing to a proactive security stance. By consistently reviewing and analyzing audit trails, organizations can identify patterns, mitigate risks, and strengthen their overall approach to operational systems access management.

Logging is key to identifying unauthorized operations. Automated alerting based on log patterns can help you respond swiftly and ensure you do not miss anything.

In addition - another important consideration is ensuring that frequent audits are conducted to determine who has access to which systems and the current role of each employee. Workflows can be implemented to remind system owners to show these periodic reviews, and leaders, directors, and VPs should conduct audit checks to ensure that system owners are indeed maintaining their environments. I highly recommend that any CIO or CSIO ensure that their company has a policy in place to hold their teams accountable for doing the right things for the organizations they serve.

In my experience, effective management of operational systems access necessitates regular review and updates to policies and procedures. Periodically assess access control policies to align them with evolving business needs, compliance requirements, and security best practices. Ensure that procedures for onboarding and offboarding employees are up-to-date, reflecting changes in roles and responsibilities. Communication of these updates to the relevant stakeholders is crucial for awareness and adherence. This proactive approach ensures that operational system access management remains robust, responsive to organizational changes, and compliant with security standards.

Consistently reviewing and updating access controls, ensuring adherence to security policies, and promptly addressing any unauthorized or suspicious activities. Continuous collaboration with cybersecurity teams to stay abreast of emerging threats and adopting proactive measures further enhances the overall security posture of operational systems.

Policies and procedures should be the start point to set the tone however this must be complemented with routine audits/ assessments to identify risk and opportunities of improvement to fine tune the policies and procedures.

Security and access policies must be regularly reviewed and updated to adapt to new threats and changes in the organizational environment. This includes periodically reviewing user access permissions, especially in cases of changing roles or leaving the company.

Role-Based Access Control (RBAC): Implement RBAC to assign permissions based on job roles and responsibilities. This approach ensures that individuals receive access privileges aligned with their specific duties, reducing the risk of unauthorized access. Least Privilege Principle: Adhere to the principle of least privilege, granting individuals the minimum level of access needed to perform their tasks. Avoid assigning broad, unnecessary permissions that could lead to security vulnerabilities. Regular Access Reviews: Conduct regular access reviews to ensure that individuals have only the necessary access privileges. This helps identify and correct any discrepancies or unauthorized access promptly.

I think a thoroughly segregated and implemented IAM process with Enterprise ZERO Security strategy (at all access touch points - Network, Application/Platform, and Device level) implemented with fine-grain and layered access control governance will help greatly. The IAM process enables business asset owners to own/control the approval process flow for granting/revoking access to the asset, makes asset owners accountable to continuously review and validate granted access with IT Auditors' periodic check but IT/Security team is strictly empowered to implement access requests approved by asset owners which also requires asset owner's validation after such is granted by IT team before access becomes effective. With SIEM and SOAR solutions.

Overall we need a framework to stick to. The one could be the Zero Trust, covering IT and OT scope (access verifications for apps, users, devices, iot, …). Nevertheless, this Zero trust model has to rely and be part of an overall Security strategy covering systematic access reviews, patterns detection capability with AI, RBAC, Communication plan, training for all employees / suppliers / stakeholders.

Regular audits within the company is a must for security purpose in this modern time. As more and more organizations are creating the hybrid workforce who work remotely, it is of utmost importance that employee access are properly audited. The security team should vigorously check employees who are leaving the organization and revoke their access immediately.

User training and awareness: Educating users about secure password practices and awareness of threats like phishing is critical. Layered security: Don't rely on a single security measure. Implement multiple layers of defense (such as firewalls, antivirus, IPS/IDS). Patch and update management: Keep operating systems and applications up to date to protect against known vulnerabilities.