Method and apparatus for enforcing realtime access controls for endpoints
The disclosed system includes privileged access management (PAM) appliance that facilitates establishing a session between an accessor device and an endpoint device. Generally, an access application can be pushed to the endpoint device. Once received, the endpoint device can automatically execute the access application. When executed, the access application can connect to the PAM appliance. The PAM appliance can establish the session between the accessor device and the endpoint device.
1 . A privileged access management (PAM) apparatus comprising at least one computing device comprising a hardware processor, the at least one computing device configured to:
push an access application to an endpoint device in response to receiving a first request from an accessor device, wherein the access application is automatically executed by the endpoint device, wherein the endpoint device and the accessor device are separate devices;
receive a second request to connect from the access application;
establish an access session between the accessor device and the access application executed by the endpoint device to provide access to at least one resource of the endpoint device based on a conversion of a first access protocol used by the PAM apparatus to a second access protocol used by the endpoint device; and
provide a credential for the accessor device for use in the access session based on an in-session policy.
2 . The PAM apparatus of claim 1 , wherein the at least one computing device is further configured to push the access application to the endpoint device based on at least one of: a system management bus, a remote procedure call, inter process communications, a file transfer protocol, a secure shell, or a hypertext transfer protocol.
3 . The PAM apparatus of claim 1 , wherein the at least one computing device is further configured to:
receive a third request from a second accessor device to access a second endpoint device;
push another access application to the second endpoint device;
receive a fourth request to connect from the other access application; and
establish a second session between the second accessor device and the second endpoint device.
4 . The PAM apparatus of claim 1 , wherein the endpoint device excludes a pre-installed access client.
5 . The PAM apparatus of claim 1 , wherein the at least one computing device is further configured to execute a push service to handle operations for pushing the access application to the endpoint device.
6 . The PAM apparatus of claim 1 , wherein the at least one computing device is further configured to manage access rights to the endpoint device.
7 . The PAM apparatus of claim 1 , wherein establishing the access session comprises providing the accessor device with real time access control to resources of the endpoint device.
8 . A method comprising:
in response to receiving a first request from an accessor device, sending an access application to an endpoint device, wherein the access application is automatically executed by the endpoint device, wherein the endpoint device and the accessor device are separate devices;
receiving a second request for connection from the access application;
establishing, via the access application, an access session between the accessor device and the endpoint device to provide access to at least one resource of the endpoint device;
converting, via a protocol agent and for the access session, a first access protocol used by a privileged access management (PAM) appliance to a second access protocol used by the endpoint device; and
granting access to a credential for the accessor device for use in the access session based on an in-session policy.
9 . The method of claim 8 , wherein sending the access application to the endpoint device is performed by the protocol agent on behalf of the privileged access management (PAM) appliance.
10 . The method of claim 9 , wherein the protocol agent communicates with the endpoint device on a local network and communicates with the PAM appliance on a wide-area network.
11 . The method of claim 8 , wherein a PAM appliance establishes the access session and the method further comprises managing, via the PAM appliance, access rights to a plurality of endpoint devices including the endpoint device and respective access session traffic.
12 . The method of claim 8 , further comprising determining the in-session policy for the access session, wherein the in-session policy grants or denies access to at least one of: a tool, a command, or a resource for the endpoint device.
13 . The method of claim 8 , wherein sending the access application to the endpoint device is performed by the accessor device.
14 . The method of claim 8 , further comprising assigning the in-session policy to the accessor device.
15 . A system comprising:
a data store comprising an access application;
an endpoint device; and
a privileged access management (PAM) appliance in communication with the endpoint device and the data store, the PAM appliance comprising a hardware processor and being configured to:
in response to receiving a first request from an accessor device, retrieve the access application from the data store, wherein the endpoint device and the accessor device are separate devices;
push the access application to the endpoint device;
receive a second request for connection from the access application;
establish an access session between the accessor device and the access application executed by the endpoint device to provide access to at least one resource of the endpoint device based on a conversion of a first access protocol used by the PAM appliance to a second access protocol used by the endpoint device; and
grant, to the accessor device, access to a credential based on an in-session policy.
16 . The system of claim 15 , wherein the endpoint device is configured to:
receive the access application from the PAM appliance; and
in response to receiving the access application, automatically execute the access application.
17 . The system of claim 15 , further comprising a protocol agent in communication via a local area network with the endpoint device, wherein the access application is pushed to the endpoint device via the protocol agent.
18 . The system of claim 15 , further comprising a protocol agent configured to:
connect to the endpoint device using the first access protocol via a first network;
connect to the PAM appliance using the second access protocol via a second network; and
perform the conversion of the first access protocol used by the PAM appliance to the second access protocol used by the endpoint device.
19 . The system of claim 15 , wherein the PAM appliance is further configured to establish a persistent connection to a protocol agent based on a certificate based authentication.
20 . The system of claim 15 , wherein the PAM appliance is further configured to further grant, to the accessor device, access to at least one of: a command or a tool on the endpoint device based on the in-session policy.