Talking about small businesses, I mean we we work with small businesses and the ultimate small business would be like a little mom and pop shop
So if you had a little like boutique or something like that, what would you sell?
You like a fishing store or a little art store?
IT
Well, it is kind of funny, I mean I feel like that probably it but I'm
I'm a nerd so it would probably be something gaming related would be my alternative my wife is in
The floral industry and she's always said that she would love to have a floral shop with me
Which is not my interest so I would be more like flowers and gaming somehow
We gotta have the guys have to have a place to go and find something interesting while the ladies are shopping. I
Don't know. I I did always say that if I get burned out from cybersecurity
I want to go work in a greenhouse, so I might be over there in the flower section
so
I'll be your I'll be your wife's first customer over there
I was gonna say probably some type of like garden center
was gonna be my answer, but
I'm also a geek and so I
Feel like I could possibly go try and buy up all the super old
connections for like computers and just to
Make it available where if you can't can't find something at you know target or something like that come here and I'll help support your
Wildly old technology and that one very obscure cable that you've been looking for forever. I might have it
Don't want to support old technology here at work, but
It'd be fun just to try and find the most obscure connections and cables and cards and all that kind of stuff
I'm sure we still got floppy disks in the office somewhere. We need to be able to read what's on them. I
Smaller micro-center, but yeah fun fact. I used to work for a company that is still using micro-fiche, so
How about you August
for me it would be I
I will take the sports advocate route and do a
Trading card and collectibles and like memorabilia store
We had one up where I went to college and I spent a pretty solid amount of time there me and the owner were on a
first-name basis and I
Even I guess I should have even worked there because I spent so much time there, but that would probably be it for me. I
Know where everything is yeah pretty much
What are you Kelsey? I
Think I have to go so much stereotypical and say bookstore like a cute little bookstore
Anybody's ever been in a wild rumpus in Minneapolis or Lyndon Hills technically neighborhood. It's in there's like
Animals and cats walking around and I'm like yes not to bring it back to my crazy cat ladies self
But yeah, 100% I'm like oh cozy reading nooks and the smell of books and then random furry animal
That was like yep. I wasn't doing this. I'd be doing that
That's a good one. I
Came up with this question and I feel like a good answer. I I
Like to go to like the candle shops just because I like to smell all the candles
Um, so maybe something like that or I like so
candles are like honey
Yeah, like little interesting like food items, you know that you can't get anywhere else
I think that would be fun to do mostly because that's the stuff I want to buy
You know, I just I'll buy a well store and I want a candle. Yeah, 100%
Yes
Kelsey you like knit or crochet right you do one of them, right? That's a good
Answer I was gonna say cuz that in still water there used to be a yarn shop and you would go there and just watch
You know a bunch of the ladies just sitting around in a circle
you know having their conversation and
Creshing or knitting and that seemed like a lot of fun, right and so
Yeah, I don't
But that would be a nice cute little location, right?
I'd still be
Next to the candle shop and then across the street will have all of your shops and the women can not to be stereotypical
Everybody can go both sides of the street y'all
Yeah, I
Love it. I love it. Well talking about small businesses. I mean that is
The world that we service and today we're talking about protecting your small business
Specifically with ham solutions. So today
Kelsey and myself are joined by Todd our COO and CISO
Nate our director of cybersecurity in August our soft technician and I'm gonna throw a challenge
I
Want like in 30 seconds so short
What is a
Pam solution and then we can go in deeper
Zero chance neither Nate or I can do it in 30 seconds. I think it's gonna have to be August
Me alright
Pam standing for privileged access management basically locking down your environment from
having
local admin running on your device
for all users so they can't run any programs as
administrator or have those elevated rights to make changes to your
computers such as
Unblanking
Like your
Your registry editor or opening PowerShell or command prompt or stuff like that. So
I
Did it that's awesome
And that's the end of the podcast thanks for coming
Where's my outro music
So if you had to expand on that because I know that Todd and Nate are both like itching to expand
What would you sort of add to that? I?
Guess one of the main things there is that
Allowing
End users to have full admin access to their systems is extremely dangerous
You know and that's not me trying to
Overplay the importance of a Pam and it's also you are talking to a security person
Right and I is kind of one of those core foundational things
But people don't always understand the true severity of it and so
This is one of the things where it's goes far beyond just that the users could potentially make a change to
their system right or install news software on that system as well, but
We know that you know fishing attacks have been greatly on the rise over the years
A lot of different metrics that you can look out there
But you know we do see it continue to spike up especially during the shift to remote workforce
But as this is happening
There's core data and files on your system that manage credentials
So your your devices they store passwords temporarily
So that way they can either minimize the number of
Minimize the number of passwords that someone has to type in to be able to log in but then also
in terms of how do you log in offline right if you have no internet can you still get in there
There's a tax and I'm not going to go into depth of them called like past the hash attacks where if someone had local admin
They had someone potentially get into that device
You can take those administrative credentials and then go log straight into the most privileged servers in the environment
And so a normal user wouldn't typically intend to do that
But it makes it extremely easy to bypass all other security controls in the environment just because they have local admin
Yeah, I'll
Back up a little bit. I we do love our acrimonial so we did Pam with thankfully August explain explained it
I know we get into SMB to which is small and medium businesses
But kind of backing up on the privileges is
Most people probably feel what privilege access looks like in the form of the UAC control and I it's just an acrimon
I could tell you couldn't tell you what it is access control, but I don't know what it is user access control
I believe
And what that is is like when you get a new software you're gonna install quick books or or the latest and greatest
Turbo tax on your own home PC you go to install and it pops up and says hey
Are you sure you want to do this?
And of course everybody says yes without thinking about it that is the initial kind of control that Windows puts into it
Unfortunately, the bad guys are incredibly clever and they go
How can I abuse everything which gets into the stuff that Nate was talking about on the deep level of past the hash and other types of things?
But essentially the reason why a lot of people tend to have administrative rights is because it's convenient
I want to update my version of Adobe whatever the case may be
Chrome is bugging me for an update whatever that may be those types of things are just hitting yes, please move on and stop bothering me
It's very very convenient
We have some very technical individuals on our team and it's no surprise that they all want to have the privileged access to do what they want
They're smart enough not to click on the bad thing etc. That being said as Nate said we're super paranoid
We're not okay with that you're gonna have to deal with some of some layer of friction just to slow you down enough
So you don't click the thing and get us into trouble
So on the deep level the reason you have privileges because it allows you to do everything right?
It gets you the ability to do the install the bad side of it is it's exactly what August and Nate were saying is you can do a whole
Bunch of stuff with admin you can edit the registry you can install additional things you didn't mean to do
The level of abuse that can be had from having admin privileges as they call it the keys of the kingdom for a reason
So I think we could dive deeper into like benefits and challenges but before we do that
You know oftentimes I'll ask
So does everybody need this and then the answer is always yes so I'm gonna pose it in
Is there is there anyone like my little mom and pop shop that has like five employees?
Is this still right for that or is there?
Kind of a line where yes, you should have it or no, it's not maybe not right
Who needs this? Well, we're insecure. So the answer is yes. Everybody needs it
So
The reason why there is a such a solution as privilege access management is because to be safe
You really shouldn't use that admin privilege day in and day out and for the most part
You really don't need that you don't need the keys to the kingdom to open up a word document or answer your email
Whatever the case may be and so if you had the ability to say day in and day out
I'm gonna use an account called Todd, but when I need to install software
I'm gonna log in as Todd admin that would be ideal most people aren't willing to do that. That's inconvenient
So the tool itself is a process of automating that transition for you
So you can be logged in as Todd normal user and it says hey, are you sure you want to do this?
This tool is intercepting that and saying I have the ability to make sure it's a secure transaction
Without giving you full blown access to everything. So my answer is yes
But I'll let the other two expand on that or disagree with me if that's the case that may be
I would say also yes
Kind of going off on Todd there since small and medium businesses are the most
attacked surfaces for
Businesses I would say that they would would be a higher risk than some of those enterprise levels
So
Yeah, what one expansion on that is the enterprise probably already has it. Yeah. Yeah, exactly
my answer is it
Depends and I'm gonna default more towards the yes
There are some very slight things that I could see where you maybe decide not to and Todd already
touched on a briefly is if you're willing to do the due diligence on
Removing those and ensuring that you aren't running something malicious
But it quickly
Starts to fail when you start talking about the
Long-term usability of that. So for example, maybe you are a very small organization and there's one person there
That's allowed to do the permissions to be able to elevate or install new software
What happens when they're on vacation? What happens when they're sick? What happens, you know in those instances?
Does the business have to stop?
to do something basic because at that point you're not a
Proving new common
item so for example, it could be a
Google Chrome update. It could be a driver update. Maybe you're
The the wireless is a little finicky. Maybe a USB driver needs to be updated
Updating just the OS it to the latest and greatest security patches, right something basic like that
As soon as you're gone from the office, it becomes extremely difficult and then it does start
Prompting you fairly often if you're trying to do some of this basic stuff
again, that's where Todd said that
When you implement something like a PAM solution it can go
pull from global policies and global
items saying that I know that any time something is an
8 signed by HP or Dell for those driver updates just automatically let it through you there is no extra prompt
Anytime there is a Chrome update or a security update to the system allow those through
without
consistently inundating the end users for admin credentials so
You can get through it without it. It's just more of a burden on the administrative side
Yeah, definitely. So we've talked a little bit about what it is and who needs it
These are we touched a little bit on the benefits and some on the challenges if you want to you know
We've talked about NFA before and that that's such an easy
cost-efficient
Everyone needs to do that. Is there any
Any challenges that people are going to face trying to implement this?
What does that look like if a business says yes, let's do it. What do they do? I?
Yeah, August I'd say
You probably have the most experience actually helping implemented but
Small and BDMI I'd say are pretty dang easy to get this implemented
But I'll let you go into more depth there
Yeah, it is kind of going off of what Nate was saying about usability and when your
Admin is gone or out sick. It's when a user is trying to install something like even a SaaS solution
and
Just a basic install if they're out of office
You can't get that installed and if you don't have an overarching MSP
You know, I would say that it's a little bit of a challenge to be managing your IT. It can be very frustrating for a user to not be able to do their basic job. So
I would say that could be a limitation of just
Availability to the user to get their work done
But I
Would say that
It's still pros and cons pros still outweigh the cons at that point, but yeah, I would say a hundred percent availability is the limitation
Yeah
Housekeeping sass is software as a service
When it comes to SMB is I don't want everybody to just focus solely on mom and pops because those do exist and that to me
There's they still mention rights. I mentioned my wife runs a flower shop. Could she use it? Absolutely
But other places where you may see a little bit more friction as we do work with a fair number of banks that may be in that smaller category
And then sometimes they outsource some of their tools to a larger organization or their core banking
This is referred to and in some of those cases
There are things that happen in the background of some of their systems that in the cybersecurity world you would consider to be malicious
And for example
One tool in particular when you launch it it tries to run this is a little bit older technology
They call it a batch file and it triggers this this tool on the outside of the application to run if you will and that is typically not
something you want to do in the cyber world and
Fortunately, unfortunately, whatever in this particular instance that is normal behavior for that particular tool set
So there is nuance in it if you just went in you install the PAM solution
It may keep you from doing some of those kinds of things going
Hey, that's not normal that that other thing shouldn't require that permission
And you just need to work through it
But the tools are designed in such a manner where they understand that modern work happens at a different pace and that the full
Belong bring in a company to its knees is not all right. So there's usually kind of a
Monitoring process if you will be formed doing a full implementation that you can kind of walk through
And of course you can always rely on experts like August to help get you up to speed as fast as humanly possible
Yeah, one of the things that I did one mention as well as
Especially the small medium businesses that are in a regulated space Todd did mention this with the core banking
But one of the main challenges that
You see in these different industries is that the auditors the regulators they will say
You are not allowed to give your users local admin, but then your critical core system
Requires admin to be able to run effectively or maybe even start
CIT we use to use an application for all of our remote access
It required local admin
but for our own
Own compliance we can't do that right so there's a conflict there and that's where the tool comes in and can solve
both of those issues
That's where again we do that with the banks we do that with other
Some of the manufacturing firms I know that sometimes they will have
Software in order to allow the shop floor to run or do AutoCAD designs maybe to create the next
Product there those ones typically require admin to be able to go modify some of the registry files when there's a new update
again, that becomes an issue and so
That's where again these these solutions are just a very nice middle layer to
Solve the interaction between the user and the system without really getting in their way too much. Yeah
So it's been a very
kind of basic overview it
Is there anything about
These PAM solutions either
Benefits or challenges or implementation
That you want to dive a little bit
I know we're kind of running out of time and we'll definitely come back to this in the future
But is there anything that you want to add or cover as we kind of finish up here?
I would say just implementation wise
It's a pretty easy rollout for most organizations since like I think Todd was touching on it briefly of
When the applications get rolled out into your environment that your PAM solution normally like
Learns your environment at that point and then you can make edits within there look at what's being
Denied what's being allowed and then also
What applications are running that local admin? I think there's a podcast about
Banks and what applications they're running as local admin and I I know that it's nice to make those edits to lock down your environment
But give that one application local admin. I think as well as what Nate was touching on so
Implementation is pretty easy
Learning your environment is easy and then switching it on when when you're all said and done so
Yeah, we don't get into it often but but the whole point of the podcast is really education, right?
So when it comes to streamlining the implementation, there is a benefit of working with an organization like CIT
As we're talking about tools like this August is giving you the guts of this is what it can do
This is how it can do it and we've learned a lot about it
The nice thing about teams like us is we work with a lot of banks
So if we know what I was talking about earlier, whether it's a it's a batch file or something along those lines
We can take that knowledge and apply it to all of the banks and we can create global policies if you will and we can say
This is the standard best practice for a bank if you will that is incredibly
Benefit and it will absolutely streamline the process of implementation
And it'll get you in the best place as fast as possible as I mentioned a little bit earlier
one other little challenge that I know comes up often is
Because every organization is at their own journey their own level of maturity
Sometimes it's not something you may have planned for and as such you just kind of got to go
Okay, well, what does that look like?
What is this costing look like and if you can't forward it today?
Start thinking about how you budgeted into the next year because it is something that is important
As I mentioned in that journey aspect
There's a 1a1b that we talk about constantly and that's a EDR and MFA get those in place as fast as reasonably possible
And then we start talking about what's next and this is one of those items that definitely falls in that category of what's next I
Was gonna make a joke here because I
So for those just listening to the audio Todd and I are wearing the same shirt here today
but then I was just about to start talking about how
At the same the shameless plug of we work with all these different organizations that are in similar spaces
so
That is one of the main benefits of if you're gonna look to work with you know, CIT for a solution like this
So August had mentioned that typically these PAM solutions
They'll go learn your environment not all of them do that and so that's
Another differentiator is there are solutions out there that can accommodate this but it's a very manual on
Inventoring all your systems finding out what software what drivers who would you know other applications are there?
What devices is it running on and then you have to go manually build all these policies?
That's why CIT found the solution that we did we use it internally
We you know work with all these other organizations to also do that
and then
Like Todd mentioned is we have global policies. We have different
subset of policies that you know, maybe only apply to your organization all the way down to you know a particular user on one workstation
for those permissions, but
That's the the benefit is if we ever see something like an HP update or something. That's just very basic
It's everything checks out properly
We can apply that at a global level potentially when
Another customer requests it so then by the time you ever try and run that same piece of software
It's just gonna allow it through there is no approval process or anything like that. So it's
It's wildly efficient once you start taking a look at how this gets deployed in scale
I feel like we went and we had quite a high overview and this is worth going into
again in the future so
if you
Definitely check out our website watch our podcast for more information
I'd like to thank Todd Nate and August for joining us today
If you have questions about these PAM solutions, we want to talk to these people you want to learn more
Please reach out to us at info at CIT-net.com or head out to our website at CIT-net.com
CIT-net.com slash podcast and we'll be back next week with an all-new episode