Method and apparatus for enforcing realtime access controls for endpoints
An approach is described for provisioning and enforcing realtime granular access controls for endpoints. The approach involves enforcing realtime access controls, via a privileged access management appliance, of a plurality of accessors, endpoints, and approvers, to provide for securing, controlling, auditing, and reporting of access to endpoints.
1. A method comprising:
detecting, via a privileged access management (PAM) appliance, an attempt to access an endpoint device by an accessor device, wherein the endpoint device is among a plurality of endpoint devices within a network, and wherein the PAM appliance manages access rights to the plurality of endpoint devices,
establishing, via the PAM appliance, a session between the endpoint device and the accessor device based on an access policy assigned to the endpoint device; and
transmitting a report of the session to an approver device based on the access policy,
wherein network traffic among the plurality of endpoint devices, the accessor device, the approver device, other systems of the network, or a combination thereof is managed by the PAM appliance.
2. A method of claim 1 , further comprising:
generating an approval request to grant the access to the endpoint device to the accessor device; and
transmitting the approval request to the approver device,
wherein the access to the endpoint device, the session between the endpoint device and the accessor device, or a combination thereof is granted based on a response from the approver device to the approval request.
3. A method of claim 2 , wherein the response to the approval request includes a grant of the access, a denial of the access, an application of one or more conditions to the access, a comment on the approval request, an application of a different access policy for the session, a joining of the approver device to the session, or a combination thereof.
4. A method of claim 2 , further comprising:
determining an approval policy associated with the approver device, the endpoint device, the accessor device, the network, or a combination thereof,
wherein the access to the endpoint device, the session between the endpoint device and the accessor device, or a combination thereof is granted further based on whether the response from the approver device complies with the approval policy.
5. A method of claim 4 , wherein the approval policy includes one or more temporal restrictions, one or more location restrictions, one or more device restrictions, a restriction what accessor devices can be approved, or a combination thereof for the approver device to respond to the approval request.
6. A method of claim 4 , wherein the approval policy includes one or more temporal restrictions, one or more location restrictions, one or more device restrictions, or a combination thereof for the access to the endpoint device, for the session between the endpoint device and the accessor device, or a combination thereof.
7. A method of claim 1 , further comprising:
determining an in-session policy for the session,
wherein the in-session policy grants or denies access to one or more tools, one or more commands, one or more credentials, one or more resources, or a combination thereof of the endpoint.
8. A method of claim 1 , wherein the access policy specifies access control restrictions that are enforced using one or more permissions, one or more settings, one or more assignments, or a combination thereof.
9. A method of claim 1 , wherein the access control restrictions include a temporal restriction, a location restriction, a resource restriction, a restriction on a number of access instances, or a combination thereof.
10. A method of claim 1 , wherein the report includes access data, audit data, log data, other session data, or a combination thereof associated with the access to the endpoint device, the session between the endpoint device and the accessor device, or a combination thereof.
11. An apparatus comprising:
at least one processor; and
at least one non-transitory memory including computer program code,
wherein the at least one non-transitory memory and the computer program code are configured to, with the at least one processor, cause the apparatus to perform at least the following:
detect, via the apparatus, an attempt to access an endpoint device by an accessor device, wherein the endpoint device is among a plurality of endpoint devices within a network, and wherein the apparatus manages access rights to the plurality of endpoint devices,
establish, via the apparatus, a session between the endpoint device and the accessor device based on an access policy assigned to the endpoint device; and
transmit a report of the session to an approver device based on the access policy,
wherein network traffic among the plurality of endpoint devices, the accessor device, the approver device, other systems of the network, or a combination thereof is managed by the apparatus.
12. An apparatus of claim 11 , wherein the apparatus is configured to further perform at least the following:
generate an approval request to grant the access to the endpoint device to the accessor device; and
transmit the approval request to the approver device,
wherein the access to the endpoint device, the session between the endpoint device and the accessor device, or a combination thereof is granted based on a response from the approver device to the approval request.
13. An apparatus of claim 12 , wherein the response to the approval request includes a grant of the access, a denial of the access, an application of one or more conditions to the access, a comment on the approval request, an application of a different access policy for the session, a joining of the approver device to the session, or a combination thereof.
14. An apparatus of claim 12 , wherein the apparatus is configured to further perform at least the following:
determine an approval policy associated with the approver device, the endpoint device, the accessor device, the network, or a combination thereof,
wherein the access to the endpoint device, the session between the endpoint device and the accessor device, or a combination thereof is granted further based on whether the response from the approver device complies with the approval policy.
15. An apparatus of claim 14 , wherein the approval policy includes one or more temporal restrictions, one or more location restrictions, one or more device restrictions, a restriction what accessor devices can be approved, or a combination thereof for the approver device to respond to the approval request.
16. An apparatus of claim 14 , wherein the approval policy includes one or more temporal restrictions, one or more location restrictions, one or more device restrictions, or a combination thereof for the access to the endpoint device, for the session between the endpoint device and the accessor device, or a combination thereof.
17. An apparatus of claim 11 , wherein the apparatus is configured to further perform at least the following:
determine an in-session policy for the session,
wherein the in-session policy grants or denies access to one or more tools, one or more commands, one or more credentials, one or more resources, or a combination thereof of the endpoint.
18. An apparatus of claim 11 , wherein the access policy specifies access control restrictions that are enforced using one or more permissions, one or more settings, one or more assignments, or a combination thereof.
19. An apparatus of claim 11 , wherein the access control restrictions include a temporal restriction, a location restriction, a resource restriction, a restriction on a number of access instances, or a combination thereof.
20. An apparatus of claim 11 , wherein the report includes access data, audit data, log data, other session data, or a combination thereof associated with the access to the endpoint device, the session between the endpoint device and the accessor device, or a combination thereof.