A typical exploit may start with the attacker first gaining access to a low-level privilege account. Once logged in, attackers will study the system to identify other vulnerabilities they can exploit further. They then use the privileges to impersonate the actual users, gain access to target resources, and perform various tasks undetected. Privilege escalation attacks are either vertical or horizontal. In a vertical type, the attacker gains access to an account and then execute tasks as that user. For the horizontal type, the attacker will first gain access to one or more accounts with limited privileges, and then compromise the system to gain more permissions to perform administrative roles. Such permissions enable the attackers to perform administrative tasks, deploy malware, or do other undesirable activities. For example, they can disrupt operations, modify security settings, steal data, or compromise the systems such that they leave open backdoors to exploit in the future. Generally, just like the cyber-attacks, privilege escalation exploits the system and process vulnerabilities in the networks, services, and applications. As such, it is possible to prevent them by deploying a combination of good security practices and tools. An organization should ideally deploy solutions that can scan, detect, and prevent a wide range of potential and existing security vulnerabilities and threats.
Best practices to prevent privilege escalation attacks
Organizations must protect all their critical systems and data as well as other areas that may look unattractive to the attackers. All that an attacker requires is to penetrate a system. Once inside, they can look for vulnerabilities that they exploit further to gain additional permissions. Other than protecting the assets against external threats, it is equally important to put enough measures to prevent internal attacks. While actual measures may differ according to the systems, networks, environment, and other factors, below are some techniques organizations can use to secure their infrastructure.
Protect and scan your network, systems, and applications
In addition to deploying a real-time security solution, it is essential to regularly scan all the components of the IT infrastructure for vulnerabilities that could allow new threats to penetrate. Towards this, you can use an effective vulnerability scanner to find unpatched and insecure operating systems and applications, misconfigurations, weak passwords, and other flaws that attackers can exploit. While you can use various vulnerability scanners to identify weaknesses in outdated software, it is usually difficult or not practical to update or patch all the systems. In particular, this is a challenge when dealing with legacy components or large scale production systems. For such cases, you can deploy additional security layers such as web application firewalls (WAF) that detect and stop malicious traffic at the network level. Typically, the WAF will protect the underlying system even when it is unpatched or outdated.
Proper privilege account management
It is important to manage the privileged accounts and ensure that they are all secure, used according to the best practices, and not exposed. The security teams need to have an inventory of all the accounts, where they exist, and what they are used for. Other measures include
Minimizing the number and scope of the privileged accounts, monitoring, and keeping a log of their activities.Analyzing each privileged user or account to identify and address any risks, potential threats, sources, and attacker’s intentsMajor attack modes and prevention measuresFollow the least privilege principlePrevent admins from sharing accounts and credentials.
Monitor user behavior
Analyzing user behavior can discover if there are compromised identities. Usually, the attackers will target the user identities which provide access to the organization’s systems. If they succeed to obtain the credentials, they will log into the network and may go undetected for some time. Since it is difficult to manually monitor each user’s behavior, the best approach is to deploy a User and Entity Behavior Analytics (UEBA) solution. Such a tool continuously monitors user activity over time. It then creates a legitimate behavior baseline which it uses to discover unusual activities that are indicative of a compromise. The resulting profile contains information such as location, resources, data files and services the user accesses and frequency, the specific internal and external networks, number of hosts as well as processes executed. With this information, the tool can identify suspicious actions or parameters that deviate from the baseline.
Strong password policies and enforcement
Establish and enforce strong policies to ensure that the users have unique and hard to guess passwords. Additionally, using a multi-factor authentication adds an extra layer of security while overcoming the vulnerabilities that may arise when it is difficult to manually enforce strong password policies. Security teams should also deploy the necessary tools such as password auditors, policy enforcers, and others that can scan systems, identify and flag weak passwords, or prompt for action. The enforcement tools ensure that users have strong passwords in terms of length, complexity, and company policies. Organizations can also use enterprise password management tools to help users generate and use complex and secure passwords that comply with policies for services that require authentication. Additional measures such as multi-factor authentication to unlock the password manager enhance its security further hence making it almost impossible for attackers to access the saved credentials. Typical enterprise password managers include Keeper, Dashlane, 1Password.
Sanitize user inputs and secure the databases
The attackers can use vulnerable user input fields as well as databases to inject malicious code, gain access, and compromise the systems. For this reason, security teams should use best practices such as strong authentication and effective tools to protect the databases and all kinds of data input fields. A good practice is to encrypt all the data in transit and at rest in addition to patching the databases and sanitizing all user inputs. Additional measures include leaving files with read-only and giving the write access to the groups and users who require them.
Train users
The users are the weakest link in an organization’s security chain. It is therefore important to empower them and train them on how to perform their tasks securely. Otherwise, a single click from a user can lead to the compromising of an entire network or system. Some of the risks include opening malicious links or attachments, visiting compromised websites, using weak passwords, and more. Ideally, the organization should have regular security awareness programs. Further, they should have a methodology to verify that the training is effective.
Privilege escalation attacks prevention tools
Preventing the privilege escalation attacks requires a combination of tools. These include but not limited to the solutions below.
User and Entity Behavior Analytics solution (UEBA)
Exabeam
The Exabeam Security Management Platform is a quick and easy to deploy an AI-based behavioral analytics solution that helps to track user and account activities across different services. You can also use Exabeam to ingest the logs from other IT systems and security tools, analyze them, and identify and flag risky activities, threats, and other issues. Features include
Logging and providing useful information for incident investigations. These include all sessions when a particular account or user accessed a service, server or application, or resource for the first time, account logs in from a new VPN connection, from an unusual country, etcThe scalable solution is applicable for a single instance, cloud, and on-premise deploymentsCreates a comprehensive timeline that clearly shows the full path of an attacker based on the normal and abnormal account or user behavior.
Cynet 360
The Cynet 360 Platform is a comprehensive solution that provides behavioral analytics, network, and endpoint security. It allows you to create user profiles including their geolocations, roles, working hours, access patterns to on-premise and cloud-based resources, etc. The platform helps to identify unusual activities such as;
First-time logins to the system or resourcesUnusual login location or using a new VPN connectionMultiple concurrent connections to several resources within a very short timeAccounts that access resources off-hours
Password security tools
Password Auditor
The password auditor tools scan the hostnames and IP addresses to automatically identify weak credentials for network services and web applications such as HTTP web forms, MYSQL, FTP, SSH, RDP, network routers, and others that require authentication. It then attempts to log in using the weak, and the common username and password combinations to identify and alert about accounts with weak credentials.
Password Manager Pro
The ManageEngine password manager pro provides you with comprehensive management, control, monitoring, and auditing solution of the privileged account throughout its entire lifecycle. It can manage the privileged account, SSL certificate, remote access as well as the privileged session. Features include
Automates and enforces frequent password resets for critical systems such as servers, network components, databases, and other resourcesStores and organizes all the privileged and sensitive account identities and passwords in a centralized and secure vault.Enables organizations to meet the critical security audits as well as compliance with regulatory standards such as the HIPAA, PCI, SOX, and moreAllows team members to securely share administrative passwords.
Vulnerability scanners
Invicti
Invicti is a scalable, automated vulnerability scanner, and management solution that can scale to meet any organization’s requirements. The tool can scan complex networks and environments while seamlessly integrating with other systems including the CI/CD solutions, SDLC, and others. It has advanced capabilities and is optimized to scan and identify vulnerabilities in complex environments and applications. Additionally, you can use Invicti to test the web servers for security misconfigurations that attackers can exploit. Generally, the tool identifies SQL Injections, remote file inclusion, Cross-site Scripting (XSS), and other OWASP Top-10 vulnerabilities in web applications, web services, web pages, APIs, and more.
Acunetix
Acunetix is a comprehensive solution with built-in vulnerability scanning, management, and easy integration with other security tools. It helps to automate vulnerability management tasks such as scanning and remediation hence enabling you to save on resources. Features include;
Integrates with other tools such as Jenkins, third party issues trackers such as GitHub, Jira, Mantis, and more.On-premise and cloud deployment optionsCustomizable to suit the customer environment and requirements as well as cross-platform support.Quickly identify and respond to a wide range of security issues including, common web attacks, Cross-site Scripting (XSS), SQL injections, malware, misconfigurations, exposed assets, etc.
Privileged Access Management (PAM) software solutions
JumpCloud
Jumpcloud is a Directory as a Service (DaaS) solution that securely authenticates and connects users to networks, systems, services, apps, and files. Generally, the scalable, cloud-based directory is a service that manages, authenticates, and authorizes users, applications, and devices. Features include;
It creates a secure and centralized authoritative directorySupports cross-platform user access managementProvides single sign-on functions that support controlling user access to applications through LDAP, SCIM, and SAML 2.0Provides secure access to on-premise and cloud serversSupports multi-factor authenticationHas automated administration of security and related functions such as event logging, scripting, API management, PowerShell, and more
Ping Identity
Ping Identity is an intelligent platform that provides multi-factor authentication, single sign-on, directory services, and more. It enables organizations to enhance user identity security and experience. Features
Single sign-on that provide secure and reliable authentication and access to servicesMulti-factor authentication that adds extra security layersEnhanced data governance and ability to comply with privacy regulationsA directory services that provide secure management of user identities and data at scaleFlexible cloud deployment options such as Identity-as-a-Service (IDaaS), containerized software, etc.
Foxpass
Foxpass is a scalable enterprise-grade identity and access control solution for on-premise and cloud deployments. It provides RADIUS, LDAP, and SSH key management features which ensures that each user only accesses specific networks, servers, VPNs, and other services at the time allowed. The tool can integrate seamlessly with other services such as Office 365, Google Apps, and more.
AWS Secrets Manager
AWS Secrets Manager provides you with a reliable and effective means to secure the secrets required to access the service, applications, and other resources. It allows you to easily manage, rotate, and retrieve the API keys, database credentials, and other secrets. There are more secret management solutions you can explore.
Conclusion
Just like the cyber-attacks, privilege escalation exploits the system and processes vulnerabilities in the networks, services, and applications. As such, it is possible to prevent them by deploying the right security tools and practices. Effective measures include enforcing the least privileges, strong passwords, and authentication policies, protecting sensitive data, reducing the attack surface, securing the accounts credentials, and more. Other measures include keeping all systems, software, and firmware up-to-date and patched, monitoring user behavior, and training users on safe computing practices.
