For any Privileged access management product, defined policies or rules determines how various privileges are accessed across the enterprise. NetIQ Privileged Account Manager provides framework which provides lot of flexibility in policy definitions to enable the granular control of privilege access.
The basic premise of Privileged Account Manager policy framework is driven by following:
There are set of resources on which the privilege access needs to be controlled and secured. And depending on organizations needs there can be multiple resources having similar privilege access and security requirement, which might be based on their usage, location, criticality to business and many other similar factors.
Then there are users across the organization who require different privileges across different systems. Again, these users can be individuals like a particular system administrator, OR may be group of users like contract employees, and Helpdesk administrators.
Policies in Privileged Account Manager define the relationship among resources with associated privilege accounts, and the users requiring those privilege access.
Privileged Account Manager policy framework achieves this by giving ability to define the following as part of a policy.
Who - User(s) Or Group requiring access
Where - Resources Or Host on which access needs to be given.
What - What access needs to be given, level of privilege required and granular application control.
When - Access Time, when the access is allowed.
How - How to govern the access, monitor the privilege session, control the risk etc.
Starting Privileged Account Manager 4.0 release, users can now use new policy definition capability, Section 6.1, Access Control. This allows administrators to create policies in user friendly, intuitive way, by allowing them to define:
Where - Set of resources having similar security and privilege access requirement into Resource Pools.
Who - Set of users and groups having need for similar privilege access into User Roles.
What, When, and How - An Assignment which is a set of permissions which determines the details of access among a particular User Role and a particular Resource pool.
Another capability in Privileged Account Manager to define policies is Section 6.2, Command Control. This capability also allows administrator to create flexible set of policies. The Policy hierarchy is very granular so that the administrator can define as many policies as possible in a tree manner and any policy can be edited to grant/deny the access to a user, host, command etc.
Some key differences in capabilities of Access Control and Command Control in Privileged Account Manager 4.0 are mentioned in the following table:
|
Capability |
Access Control |
Command Control |
|---|---|---|
|
Structure of Policy set |
|
|
|
Defining Host/Resources |
|
|
|
Defining Users/Groups |
|
|
|
Defining Policies |
|
|
|
User Experience/ UI |
|
|
|
REST API |
|
|
|
Privilege Governance |
|
|
|
AA/RADIUS support |
|
|
|
IDM Driver support |
|
|
|
Policy Templates |
|
|
You can either use Command Control or Access Control based on the relevance and the environment. You can enable or disable either Command Control or Access Control policy engine, by going to Settings > > Server Settings > Policy Engine. Use the slider to enable the status of either the Access Control Engine or the Command Control Engine.