CISO Guide: Cyber Resilience – How to Build a Data Security Program Resilient to Admin Compromise Post LastPass Breach

Executive Summary Up Front

• Admin compromises inflict maximum damage due to the extent of privilege associated with admin accounts
• Admin attacks can result in encrypted data loss (not a big problem as long as the encryption is strong and preferably NIST validated), clear text data loss (very big problem), and loss of encryption keys (enormous problem: Last Pass is an example)
• Modern Data Security Platforms (such as Portal26) enable data security programs that can be resilient to admin compromise

How Can You Create Cyber Resilience Against Admin Compromise? Key Attributes to Look For

1. Independence of Controls: Independent controls for access management and data security (access alone does not guarantee clear text data).
2. Data-in-Use Protection: Admins should never see clear text data even if logged in with highly privileged credentials (data-in-use protection/ encryption-in-use/searchable encryption).
3. Segregation of Duties: The same admin should not be able to access encrypted digests as well as associated encryption keys,
4. Not Using Vault Generated Keys Directly: Encryption keys from key vaults should never be used directly, rather encryption keys should be derived from vault generated keys in real-time to ensure that stolen vault generated keys do not automatically result in large scale data compromise. Look for NIST certified key derivation functions (KDFs)

LastPass Security Incident – The Background

This edition of the Portal26 Data Security Blog is focused on Admin Compromise. The LastPass data breach highlights the fragility of enterprise data security controls. The LastPass breach is this nightmare scenario playing out in real life.

Portal26 was purpose built to enable enterprises to withstand admin compromise

In our early days we would carefully explain to anybody that while user compromises are unfortunate and should be avoided, the biggest risks lie in compromised admins.

How To Build A Data Security Programme Resilient To Admin Related Data Risk

Here we will share what CISOs should look at while modeling admin compromise risk and how they can build a data security program that is more resilient to admin related data risks.

Users Vs. Admins: Risk matrix

Data is the most important asset in the enterprise. It is important to keep data secure while ensuring availability for users.

Managing User Data Risk

User related risks can be managed in the following ways:

• Advanced access control measures such as granular access control, attribute based access control (ABAC), and policy based access control (PBAC)
• Combining access control with data security controls so that even if a user is permitted access to data, it can be presented in privacy preserving formats.
• Segmenting back end data using granular encryption keys to contain the blast radius in the event that a user gets compromised.

Managing Admin Data Risk

The framework here has to be very simple. If admins get compromised, whatever they have access to will get compromised as well.

Security Best Practices For Administrator Accounts

Four recommended steps towards making your enterprise data security program resilient to admin compromises:

• Independence of Controls: Adding an admin focused data security control layer independent of access management.
• Data-in-use protection: Ensuring that any file system or database admin cannot see any data in clear text even if they have full privileges to the server or the database.
• Segregation of Duties: Encryption keys should never be stored along with the data.
• Not Using Vault Generated Keys Directly: NIST provides guidance on how to use Key Derivation Functions (KDFs) to create strong keys for data encryption.

Solutions To Secure Data Against Administrator Compromise

Portal26 powers enterprise-wide data security programs that are resilient against admin compromises as well as compromised encryption keys.