Skip to content
Contact us
All posts

Protecting Critical Infrastructure: Reducing Vulnerabilities Using Privileged Access Management

By   ·  2 minute read

Between growing security threats and evolving compliance regulations, global governments and agencies are facing increased risk and pressure to secure outdated Critical Infrastructure Plans (CIP). Simply by targeting critical infrastructure, bad actors can gain political leverage over powerful organizations and institutions by virtue of access to critical services. 

Just in the first half of 2019, IBM’s X-Force Incident Response & Intelligence Services found a 200% rise in attacks on critical infrastructures. From the 2017 Shamoon malware attack on Saudi Arabian oil giant Aramco to the 2019 ransomware attack causing production stoppage in Norway, the last decade has seen its fair share of cyberattacks.

Attacks on critical infrastructures present novel and sophisticated scenarios that put entire countries and communities at risk. For example, one study indicates that a hypothetical attack on the US power grid has a potential 70-90% percent casualty rate within 12 months.

Learn more on Critical Infrastructure Security and HUB Security Solutions

With these scenarios in mind, the European Commission released the NIS Directive, a set of four key strategies designed to manage cyber-threats across critical infrastructures:

  • Managing Cyber Risk
  • Protecting Against Cyber Attack
  • Detecting Cyber Security Events
  • Minimizing the Effects of Cyber Security Incidents

Identity & Privileged Access Management (IAM & PAM)

Five years after the release of the European Commission’s NIS Directive, we’ve come to learn the importance and key role of Identity Access Management (IAM) and Privileged Access Management (PAM) in controlling access to internal critical infrastructure systems.

We already know that our most critical environments require additional, more complex layers of security and control. We see similar policies leveraging IAM and PAM come into play when it comes to security software – but when it relates to CIS, security experts must take further steps to protecting privilege and identity management. 

Endpoint Privilege Management (EPM)

Beyond traditional password management, there is also a need to control the kinds of actions which are permitted to users. The NIS outlines the importance of organizations to put in place policies that limit and control which specific devices can perform which actions.

While password management and secure vaulting may be beneficial in these cases, the NIS directive takes things further by highlighting the need for policies which define what actions specific users can perform on specific endpoints - beyond basic access privileges.

Security experts forecast a significant rise in ransomware-related attacks in 2020, with critical services, such as financial services and utilities, becoming the focus of more and more attention. This is where Endpoint Privilege Management (EPM) comes into play as a key component of PAM, enabling businesses to effortlessly implement intelligent application policies across their organization, while removing local admin rights in order to ensure resilience against malware.

Hardware Security Modules & Access Management

There has never been more reasons to ensure your organization has proper IAM, PAM and EAM policies in place to prevent cyberattacks from causing long-term infrastructure damage which can lead to critical outages, data breaches and loss of money.

The use of a Hardware Security Module (HSM) is critical for any organization looking to protect access to its most sensitive and secure environments. A core component of an HSM’s centralized design is the advantage of streamlining the management of keys, providing a complete overview of keys across multiple systems.

Hardware security modules safely store secure keys, digital assets, and other business applications in an isolated environment. HUB Security’s mini HSM solution is built for sensitive and complex approval flows, such as secure access to critical infrastructure, payments, transfer of assets, code signing, and identity management.