Detecting shared or compromised credentials through analysis of simultaneous actions
View Patent ↗A privileged account management system can detect when credentials used to access one or more servers have been shared or otherwise compromised. This detection can occur through analysis of simultaneous actions that are performed via multiple sessions associated with the same administrator. When two or more sessions associated with the same administrator are opened, the interactions performed over each of the sessions can be monitored to identify whether such interactions could be performed by a single administrator. If it is determined that the interactions over the multiple sessions could not reasonably be performed by a single administrator, various actions can be taken to address the possible breach to the security of the one or more servers.
1. A method, implemented by a privileged account management system, for detecting when multiple individuals are likely interacting with multiple privileged sessions that are associated with a single administrator, the method comprising:
monitoring multiple privileged sessions that are each associated with a single administrator, each of the multiple privileged sessions being concurrently established using the same admin credentials, the multiple privileged sessions including a first privileged session that is established with a first client device and a second privileged session that is established with a second client device;
while monitoring the multiple privileged sessions, detecting that first data is transmitted over the first privileged session at a first time and that second data is transmitted over the second privileged session at a second time;
comparing the first time to the second time to determine that the second time is within a threshold of the first time;
analyzing the first data and the second data to determine that the first data represents first user input to the first client device and that the second data represents second user input to the second client device;
based on the comparison and the analysis, determining that it is unlikely that the single administrator provided the first user input and the second user input; and
in response to determining that it is unlikely that the single administrator provided the first user input and the second user input, causing an action to be performed to mitigate risk to one or more servers accessible via one or both of the first and second privileged sessions.
2. The method of claim 1 , wherein one or both of the first and second privileged sessions comprises a remote session between the client device and a component of the privileged account management system and a remote session between the component and one of the one or more servers.
3. The method of claim 2 , wherein the component is a proxy.
4. The method of claim 2 , wherein the component is a hosted session component.
5. The method of claim 1 , wherein one or both of the first and second privileged sessions comprises a remote session between the client device and an agent component of the privileged account management system that resides on one of the one or more servers.
6. The method of claim 1 , wherein detecting that first data is transmitted over the first privileged session at a first time and that second data is transmitted over the second privileged session at a second time comprises:
identifying that the first data is received by the privileged account management system at the first time and that the second data is received by the privileged account managements system at the second time.
7. The method of claim 1 , wherein the threshold is based on a latency of the privileged sessions.
8. The method of claim 1 , wherein the first data and the second data each represent human interaction with a human input device.
9. The method of claim 8 , wherein determining that it is unlikely that the single administrator provided the first user input and the second user input comprises:
determining that the first data and the second data both represent one of keyboard input or mouse input.
10. The method of claim 8 , wherein determining that it is unlikely that the single administrator provided the first user input and the second user input comprises:
determining that the first data represents keyboard input and the second data represents mouse input.
11. The method of claim 1 , wherein analyzing the first data and the second data to determine that the first data represents first user input to the first client device and that the second data represents second user input to the second client device further comprises:
comparing the second data to the first data to determine whether both the first data and the second data represent a same sequence of commands that are likely generated using automation technology.
12. The method of claim 1 , wherein determining that it is unlikely that the single administrator provided the first user input and the second user input comprises:
determining that a single individual is not capable of providing the first user input and the second user input simultaneously.
13. The method of claim 1 , wherein the action comprises one or more of:
closing one or both of the first and second privileged sessions;
recording one or both of the first and second privileged sessions;
alerting a security officer; or
flagging data associated with one or both of the first and second privileged sessions.
14. The method of claim 1 , wherein the first and second privileged sessions each comprise one of an SSH session or an RDP session.
15. One or more computer storage media storing computer executable instructions which when executed by one or more processors of a privileged account management system implement a method for detecting when multiple individuals are likely interacting with multiple privileged sessions that are associated with a single administrator, the method comprising:
monitoring multiple privileged sessions that are each associated with a single administrator, each of the multiple privileged sessions being concurrently established using the same admin credentials, the multiple privileged sessions including a first privileged session that is established with a first client device and a second privileged session that is established with a second client device;
while monitoring the multiple privileged sessions, detecting that first data is transmitted over the first privileged session at a first time and that second data is transmitted over the second privileged session at a second time;
comparing the first time to the second time to determine that the second time is within a threshold of the first time;
analyzing the first data and the second data to determine that the first data represents first user input to the first client device and that the second data represents second user input to the second client device;
based on the comparison and the analysis, determining that it is unlikely that the single administrator provided the first user input and the second user input; and
in response to determining that it is unlikely that the single administrator provided the first user input and the second user input, causing an action to be performed to mitigate risk to one or more servers accessible via one or both of the first and second privileged sessions.
16. A privileged account management system comprising:
one or more processors; and
one or more computer storage media storing computer executable instructions which when executed by the one or more processors implement a method for detecting when multiple individuals are likely interacting with multiple privileged sessions that are associated with a single administrator, the method comprising:
establishing a first privileged session between a first client device and a first server, the first privileged session being established using admin credentials that are checked out to an administrator;
while the first privileged session is established, establishing a second privileged session between a second client device and the first server or a second server, the second privileged session also being established using the admin credentials that are checked out to the administrator;
monitoring data transmitted over the first and second privileged sessions; receiving first data that is transmitted over the first privileged session and second data that is transmitted over the second privileged session;
analyzing the first data and the second data to determine that the first data represents first user input to the first client device and the second data represents second user input to the second client device;
determining that the first user input and the second user input occurred simultaneously thereby indicating that the administrator likely did not provide both the first user input and the second user input; and
causing an action to be performed to mitigate risk to the first or second servers.
17. The privileged account management system of claim 16 , wherein determining that the first user input and the second user input occurred simultaneously comprises determining that a first time when the first data is received is within a threshold of a second time when the second data is received.
18. The privileged account management system of claim 16 , wherein the method further comprises:
receiving third data that is transmitted over the first privileged session and fourth data that is transmitted over the second privileged session;
analyzing the third data and the fourth data to determine that the third data represents third user input to the first client device and the fourth data represents fourth user input to the second client device;
determining that the third user input and the fourth user input occurred simultaneously thereby indicating that the administrator likely did not provide both the third user input and the fourth user input; and
causing a further action to be performed to mitigate risk to the first or second servers.
19. The privileged account management system of claim 16 , wherein the further action comprises closing one or both of the first and second privileged sessions.