Thycotic Access Controller

Digital transformation has expanded organizations’ reliance on cloud, IoT, AI, and big data, but it also increases cybersecurity, compliance, and identity risk across extended and hybrid infrastructures. These risks are heightened by the rapid, frequent access requests typical of modern digital environments, making Privileged Access Management (PAM) a central control for enforcing secure, least-privilege access. Privileged users span both business roles (access to sensitive data like HR, payroll, finance, intellectual property, and social media) and IT roles (access to system, software, and operational accounts). Core drivers for privilege management include shared credential abuse, unauthorized elevation, credential hijacking, third-party privilege abuse, accidental misuse, and the need for attestation and accountability.

Beyond security threats, PAM must support operational and regulatory needs such as privileged account discovery, ownership tracking, single sign-on efficiency, activity recording and monitoring, and controlled access for outsourcing vendors, MSPs, and cloud services. Post-COVID budget constraints and remote work realities intensify the requirement to balance cost, time-to-value, usability, and security, especially for SaaS and database access from untrusted networks and devices.

Thycotic’s PAM offering was expanded after acquiring Onion ID in early 2020, adding three Access Controller products: Cloud Access Controller, Remote Access Controller, and Database Access Controller. Cloud Access Controller adds granular RBAC to SaaS and cloud consoles, removes passwords from user flows via a bring-your-own-MFA model, supports geo/location rules, session recording, and just-in-time time-bound access. Remote Access Controller enables browser-based access with centralized MFA support, VDI, and strong data leak prevention controls including granular restrictions like disabling copy/paste and isolating risky access. Database Access Controller centralizes access to major databases, enforces MFA by default, supports automatic PII redaction, and provides recording, reporting automation, alerting, and connection cutoffs. Strengths include usability, fast deployment via MFA/SSO integration, and extending PAM into web apps and social media, while challenges include workflow disruption and user friction from strict document controls.

• Digital transformation increases cybersecurity, compliance, and identity risks as organizations adopt cloud, IoT, AI, and big data across extended infrastructures.
• Privileged users are categorized as privileged business users and privileged IT users.
• Key PAM challenges include abuse of shared credentials, hijacking of privileged credentials, and accidental misuse of elevated privileges.
• Operational and regulatory PAM requirements include discovery of shared/service accounts and auditing, recording, and monitoring privileged activities.
• Organizations face tighter budget controls after the COVID-19 crisis while needing secure remote access to SaaS applications and databases.
• Thycotic acquired Onion ID in early 2020.
• Thycotic added three products: Cloud Access Controller, Remote Access Controller, and Database Access Controller.
• Cloud Access Controller enforces role-based access control for SaaS applications and management consoles.
• Database Access Controller supports major databases including Mongo, Redis, AWS RDS, Oracle, and MySQL.
• Database Access Controller enables multi-factor authentication by default for access to all databases and supports automatic redaction of personally identifiable information.

• “Digital transformation is no longer optional for businesses and organizations if they wish to stay competitive and deliver greater value to customers.”
• “As agile access and identity requests are a prime characteristic of a successful digital environment it follows that one of the most important tools to manage this securely is Privileged Access Management (PAM).”
• “Until recently, such applications fell outside the traditional PAM paradigm, but hijacking of a corporate social media accounts, by exploiting a weak or stolen password, can cause irreparable harm to an organization.”
• “Over-privileges are a common occurrence for IT users accessing corporate IaaS management consoles, leading to inadvertent unauthorized configuration changes and even intentional abuse.”
• “Secure, single pane of glass access will become a more common way for remote and on-premises users to access enterprises resources, especially as organizations look to lower-cost hardware (i.e., Chromebooks) or transition to more BYOD-models.”
• “PAM is no longer a static function, relegated to an IT team, to protect only the most high-risk IT systems, like Windows, Unix and Linux servers.”
• “Privileged Users span departments and groups within the organization and high-risk systems now include applications like Salesforce, Corporate Social Media, accounting, and finance software, etc.”
• “Moving from user to task based access allows for better control of functions and protection of data in business-critical applications.”
• “Fine grained access control of activity is also a plus in this set of tools.”
• “The Remote Access Controller stands out for its use of virtual desktop technology to provide users with privileged access to files, applications, and databases.”