Just-in-time access policies workflow

A workflow for Password Safe

Standing access to privileged credentials increases the risk that an account is misused or compromised. A Just- in-time access policy limits when and how long a user can request a password, session, or application. This reduces the window of exposure and gives you a record of exactly when access was granted.

Scope of this guide

This workflow shows you how to define a just-in-time access policy in Password Safe. An access policy sets the time frame and frequency that users can request passwords, remote access sessions, or applications.

Prerequisites

• You have IT Administrator or Security Engineer permissions in BeyondInsight.
• Password Safe is set up and licensed.
• A user group and its associated Smart Rule for managed accounts already exist.
• If you plan to assign a connection profile for RDP access, the profile already exists.

Steps

Step 1: Create the access policy

1. Sign in to the BeyondInsight console.
2. Navigate to Configuration > Privileged Access Management Policies > Access Policies.
3. In the Access Policies pane, select Create New Access Policy.
4. Enter a name for the policy, then select Create Access Policy.
5. On the Basic Details tab, enter a description for the policy.
6. Optionally, enable Email Notifications to alert recipients when a request comes in for the policy. Add each recipient email address one at a time using Add Another Email.

Step 2: Define the schedule

1. Select the Schedule tab, then select Create Schedule.
2. Set the recurrence, time, and date settings that define when users can request access.
3. If you select a daily recurrence, you can enable Allow multi-day check-outs of accounts to let a user keep continuous access across several days.
4. Optionally, enable Location Restrictions and select an approved location from the list.
5. If your environment uses a load balancer or proxy, optionally select an address from the X-Forwarded-For list to verify the forwarded IP address against a trusted address group.

Step 3: Set access type and session controls

1. Select one or more access types to permit: View Password, RDP, SSH, or Application.

2. For each access type, set the Approvers value, or check Auto Approve to skip approval.

3. Set Record, Keystroke Logging, and Enhanced Session Auditing based on your audit requirements.

4. Set the Concurrent value to limit how many sessions a user can run at once, or check Unlimited to allow any number.

5. Enable Log off on Disconnect to log off a user automatically when a session disconnects, and enable Force Termination to end a session when the time period expires.

6. For RDP access, optionally enable RDP Admin Console and select a profile from Connection Profile.

   RDP Admin Console sessions disable some Remote Desktop features, including Remote Desktop Services client access licensing, time zone redirection, Remote Desktop Connection Broker redirection, and Remote Desktop Easy Print.

7. Under Policy Options, enable Reason is required for new requests if users must explain each request, and enable Require a ticket system and a ticket number for requests if users must supply a ticket number. If you enable the ticket option, select a Ticket System from the dropdown, or leave it as User Selected to let the user choose at request time.

8. Select Create Schedule to save the policy. If the policy is not yet marked as available, activate it when prompted.

Step 4: Assign the policy to a user group

1. Select the Assignees tab, then select Manage Assignees. You are taken to the User Management page.
2. Select the vertical ellipsis for a group, then select View Group Details.
3. From the Group Details pane, select Smart Groups.
4. Select the vertical ellipsis for a managed account Smart Group, then select Edit Password Safe Roles.
5. Check Requestor, then select the access policy you created in Step 1 from the dropdown.
6. Select Save Roles.

Verify the results

Confirm that the user group is listed on the Assignees tab for the access policy. Verify that a user in the assigned group can submit a request from the Requests page in the web portal, and that the request honors the time frame, frequency, and access type you configured.

Next steps

• Add local admin accounts for Windows servers so the policy has accounts to manage.
• Configure a rotation policy for managed accounts.
• Create a Smart Rule to group managed accounts by system or platform.