You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/design-solutions-secure-privileged-access/includes/1-introduction-privileged-access.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -40,28 +40,28 @@ Securing Privileged Access has two simple goals
40
40
41
41
There are two types of pathways to accessing the systems, user access (to use the capability) and privileged access (to manage the capability or access a sensitive capability)
42
42
43
-
:::image type="content" source="../media/privileged-access-strategy-step1-no-third-party-icons.png" alt-text="Diagram showing Two pathways to systems user and privileged access." lightbox="../media/privileged-access-strategy-step1-no-third-party-icons.png":::
43
+
:::image type="content" source="../media/privileged-access-strategy-step-1.png" alt-text="Diagram showing Two pathways to systems user and privileged access." lightbox="../media/privileged-access-strategy-step-1.png":::
44
44
45
45
- User Access - the lighter blue path on the bottom of the diagram depicts a standard user account performing general productivity tasks like email, collaboration, web browsing, and use of line-of-business applications or websites. This path includes an account logging on to a device or workstation, sometimes passing through an intermediary like a remote access solution, and interacting with enterprise systems.
46
46
- Privileged Access - the darker blue path on the top of the diagram depicts privileged access, where privileged accounts like IT Administrators or other sensitive accounts access business-critical systems and data or perform administrative tasks on enterprise systems. While the technical components may be similar in nature, the damage an adversary can inflict with privileged access is much higher.
47
47
48
48
The full access management system also includes identity systems and authorized elevation paths.
49
49
50
-
:::image type="content" source="../media/privileged-access-strategy-step2-no-third-party-icons.png" alt-text="Diagram showing Two pathways plus identity systems and elevation paths." lightbox="../media/privileged-access-strategy-step2-no-third-party-icons.png":::
50
+
:::image type="content" source="../media/privileged-access-strategy-step-2.png" alt-text="Diagram showing Two pathways plus identity systems and elevation paths." lightbox="../media/privileged-access-strategy-step-2.png":::
51
51
52
52
- Identity Systems - provide identity directories that host the accounts and administrative groups, synchronization and federation capabilities, and other identity support functions for standard and privileged users.
53
53
- Authorized Elevation Paths - provide means for standard users to interact with privileged workflows, such as managers or peers approving requests for administrative rights to a sensitive system through a just-in-time (JIT) process in a Privileged Access Management / Privileged Identity management system.
54
54
55
55
These components collectively comprise the privileged access attack surface that an adversary may target to attempt to gain elevated access to your enterprise:
56
56
57
-
:::image type="content" source="../media/privileged-access-strategy-step3-no-third-party-icons.png" alt-text="Diagram showing the attack surface unprotected." lightbox="../media/privileged-access-strategy-step3-no-third-party-icons.png":::
57
+
:::image type="content" source="../media/privileged-access-strategy-step-3.png" alt-text="Diagram showing the attack surface unprotected." lightbox="../media/privileged-access-strategy-step-3.png":::
58
58
59
59
> [!NOTE]
60
60
> For on-premises and infrastructure as a service (IaaS) systems hosted on a customer-managed operating system, the attack surface dramatically increases with management and security agents, service accounts, and potential configuration issues.
61
61
62
62
Creating a sustainable and manageable privileged access strategy requires closing off all unauthorized vectors to create the virtual equivalent of a control console physically attached to a secure system that represents the only way to access it.
63
63
64
-
:::image type="content" source="../media/privileged-access-strategy-step4-no-third-party-icons.png" alt-text="Diagram showing the protected attack surface." lightbox="../media/privileged-access-strategy-step4-no-third-party-icons.png":::
64
+
:::image type="content" source="../media/privileged-access-strategy-step-4.png" alt-text="Diagram showing the protected attack surface." lightbox="../media/privileged-access-strategy-step-4.png":::
0 commit comments