“Shared superuser accounts – typically system-defined in operating systems, databases, network devices and elsewhere – present significant risks when the passwords are routinely shared by multiple users.” Gartner MarketScope for Shared-Account/Software-Account Password Management, 2009

Mainframes –UID=0, Line-of-business –RACF Special, … Applications –Setup, Admin, App Local –Web Service Accounts, … VM Environments –Administrator –Root Server, Desktop & Network OS –Administrator, Domain/Local –Root, Super user, Admin, … Databases (DBA + Apps) –SA, Sysadmin –SYS, … Middleware –Proxy Accounts –Gateway Accounts, …

Manual Processes –Error-Prone –“Like Painting the Golden Gate Bridge…” Or, Never Changed

ERPM Architecture

Password Recovery Console

Audited Password Check Out

Dashboard Drill Down

Shared Hardware Host Operating System Hosted Virtualization HypervisorHypervisor Virtual Machine #1 Virtual Machine #1 OS Applications Virtual Machine #2 Virtual Machine #2 OS Applications Virtual Machine #n Virtual Machine #n OS Applications Every privileged identity – in every host OS, guest OS, and application – presents a potential security threat if unsecured.

Document that You Have Measures In Place To… FISMA NIST Special Publication R. 3 Defense Contractors, Information Processors HIPAA Providers, Insurance Plans, Employers, Health Care Clearinghouses NERC Transmission Service Providers / Owners / Operators, Generation Owners / Operators, Load Serving Entities, … PCI-DSS Entities that store, process, or transmit credit card data US NRC Regulatory Guide 5.71 Operators, Vendors, Contractors Identify and track the location of privileged account credentials AC-2 AC-4 B.R5.1. (Implicit) Appendix A, B.1.2 Appendix A, B.1.3 Appendix A, B.1.4 Enforce rules for password strength, uniqueness, change frequency AC-2 45§ (5)(D) 45§ (2)(i) B.R B.R B.R Appendix A, B.1.2 Delegate so that only appropriate personnel can access AC-3 AC-6 45§ (3)(i) 45§ (3)(B) 45§ (3)(C) 45§ (a)(1) B.R5.1. B.R5.2. B.R B.R Appendix A, B.1.2 Appendix A, B.1.3 Appendix A, B.1.5 Appendix A, B.1.6 Audit and alert to show requesters, access history, purpose, duration, etc. AU-3 AU-9 45§ (5)(C) B.R Appendix A, B.1.2 Appendix A, B.1.3

Grant Access to Privileged Credentials within SCOM/SCCM Interface Update SCOM Credentials Provide Trouble Ticket Integration with SCSM

Right-Click to Recover Passwords in SCCM, SCOM

Privileged Identity Incident in SCSM

$password = Get-LSPasswordWithReason $token devpat3 DomainName TestUser “Adding machine to domain” $DomainCredential = New-Object System.Management.Automation.PSCredential TestUser $password Add-Computer –DomainName DomainName –Credential $DomainCredential Set-LSPasswordCheckIn $token devpat3 DomainName TestUser “Added machine to domain ”

$LocalAccounts = Get-LSListWindowsAccountsForSystem $token devpat3 # create a new empty array to store our local admin accounts $LocalAdmins foreach ($account in $LocalAccounts) { # this will add only the accounts that have admin permissions to the list for job creation if ($account.Privilege -eq 2) { $LocalAdmins = $LocalAdmins + $account; } Foreach ($LocalAdmin in $LocalAdmins) { # this creates a new job for each local admin account on the system, will not create the account if it is not found, sets the password to a random 14 character string, and schedules the job to run immediately. New-LSJobWindowsChangePassword $token devpat3 $LocalAmdin.AccountName $false 14 - RunNow }

Complete your session evaluations today and enter to win prizes daily. Provide your feedback at a CommNet kiosk or log on at Upon submission you will receive instant notification if you have won a prize. Prize pickup is at the Information Desk located in Attendee Services in the Mandalay Bay Foyer. Entry details can be found on the MMS website.