On this article, we are going to present a quick overview of Silverfort’s platform, the primary (and at present solely) unified id safety platform available on the market. Silverfort’s patented know-how goals to guard organizations from identity-based assaults by integrating with current id and entry administration options, comparable to AD (Lively Listing) and cloud-based companies, and lengthening safe entry controls like Danger-Based mostly Authentication and MFA (Multi-Issue Authentication) to all their assets. This consists of on-prem and cloud assets, legacy programs, command-line instruments and repair accounts.
A latest report by Silverfort and Osterman Analysis revealed that 83% of organizations worldwide have skilled information breaches as a consequence of compromised credentials. Many organizations admit that they’re underprotected towards identity-based assaults, comparable to lateral motion and ransomware. Assets like command-line entry instruments and legacy programs, that are broadly used, are notably difficult to guard.
Getting Began: Utilizing the Dashboard
Beneath is a screenshot of Silverfort’s dashboard (determine 1). Total, it has a really intuitive consumer interface. On the left is an inventory of consumer varieties: privileged customers, customary customers, and repair accounts, and the way they entry assets: by on-prem and cloud-based directories (AD, Azure AD, Okta), federation servers (Ping, ADFS), and VPN connections (RADIUS). The suitable aspect of the display shows an inventory of the completely different useful resource varieties customers try to entry. The entry makes an attempt are represented by glowing dots.
This show showcases the platform’s distinctive differentiator – it is the one answer in the present day that is able to integrating with the whole id infrastructure within the hybrid atmosphere. With this integration in place, the completely different on-prem and cloud directories ahead each authentication and entry try to Silverfort for evaluation and verdict whether or not to permit entry or deny. In that method, actual time safety for any consumer and useful resource is achieved, as we’ll quickly see in additional element.
The dashboard additionally reveals aggregations of helpful identity-related information: variety of authentication makes an attempt by protocols and directories, proportion of verified authentications, variety of customers and repair accounts efficiently protected, and a breakdown of customers by danger degree (medium, excessive, important).
The platform consists of numerous modules with each addressing a special id safety challenge. We’ll now discover two of them: Superior MFA and Service Account Safety.
Defending Assets with Superior MFA
MFA has confirmed to be one of the vital efficient methods to guard towards identity-based assaults. Nonetheless, having MFA safety on all community property is fairly laborious.
MFA historically depends on brokers and proxies, which implies some computer systems won’t ever be coated by it. Both as a result of your community is simply too giant to have proxies on each single laptop, or as a result of not all computer systems are able to putting in brokers.
Wish to see Silverfort in motion? Schedule a free demo with our crew of consultants in the present day!
Furthermore, command-line entry instruments, comparable to PsExec, PowerShell, and WMI, regardless of being broadly utilized by community admins, don’t natively help MFA. These and different on-prem authentications are managed by AD, however AD authentication protocols (Kerberos, NTLM) had been merely not designed for MFA, and attackers know that. AD solely checks whether or not usernames and passwords match, so attackers utilizing authentic credentials (which can or will not be compromised) can entry the community and launch lateral motion and ransomware assaults with out AD realizing. Silverfort’s main benefit is that it could actually really implement MFA on all of those, one thing different options cannot.
On the coverage display (determine 2) you’ll be able to view current insurance policies or create new ones.
 |
| Determine 2: Coverage display |
Creating a brand new coverage appears fairly intuitive, as seen in determine 3. We have to decide the authentication kind, the related protocols, what customers, sources, and locations the coverage covers, and the motion required. What occurs right here is definitely fairly easy, however surprisingly intelligent. AD sends all authentication and entry requests to Silverfort. For every request, Silverfort analyzes its danger and related insurance policies to find out whether or not MFA is required or not. Relying on the decision, the consumer is granted entry, blocked, or requested to offer MFA. In different phrases, the coverage principally bypasses the inherent limitations of older protocols and enforces MFA on them.
 |
| Determine 3: Making a coverage |
Discovering and Securing Service Accounts
Service accounts are a important safety problem as a consequence of their excessive entry privileges and low to zero visibility. Furthermore, service accounts aren’t people, so MFA is not an possibility, and so is password rotation with PAM, which can crash important processes if their logins fail. In actual fact, all organizations have a number of service accounts, typically as many as 50% of their total customers, and plenty of of them go unmonitored. That is why attackers love compromised service accounts- they will use them for lateral motion below the radar and achieve entry to numerous machines with out being observed.
Determine 4 reveals the Service Accounts display. As Silverfort receives all authentication and entry requests, it is ready to determine service accounts by analyzing repetitive machine behaviors.
 |
| Determine 4: Service Accounts display |
It appears to be like like now we have 162 accounts below machine-to-machine. We will filter them based mostly on a wide range of parameters. Predictability, for instance, measures repeated entry to the identical supply or vacation spot. Deviations from this sample can point out malicious exercise.
In determine 5, we will see further details about our service accounts, comparable to sources, locations, danger indicators, privilege ranges, and utilization.
 |
| Determine 5: Service account Investigation display |
For every service account, insurance policies are robotically created based mostly on its conduct. All now we have to do is select between ‘alert’, ‘block’ and ‘alert to SIEM’, and allow the coverage (determine 6).
 |
| Determine 6: Service account insurance policies |
Remaining Ideas
Silverfort’s platform really achieves its purpose of unified id safety. Its means to implement MFA on virtually any useful resource (comparable to command-line instruments, legacy apps, file shares, and plenty of others) and create insurance policies in seconds is unparalleled. Having full visibility into all service accounts and eventually with the ability to shield them is extraordinarily helpful. To conclude, Silverfort’s platform presents modern id safety capabilities which can be changing into more and more crucial every day.