Didier Cohen: Forget About Complex PAM Projects: Now’s the Time for Quick, Easy and TCO-efficient Privileged Access Management

So, thank you very much. So, so the, the first things is to answer a basic question, which is basically why do we really need privilege access management? The response is very simple. Privilege management is important because of the increasingly fast transformation that is happening within all the businesses and organizations are changing migration to the cloud is importantly increasing, increasing hybrid. It are now the norm. And the result of that is that you have more and more and more privileged users within all organizations.

And when you know that 80% of breaches of successful breaches are linked to the usage of the privileged accounts, then you understand that in order to cope with the expansion of the tax surface, which is everywhere in order to cope with attackers, which are more and more efficient, which do harm very, very quickly, you need some advanced privilege access management solutions. And those solutions use are, are used by a lot of users. It team workers, remote workers, contractors, partners, even developers and develop are involved in that.

And of course, when you look at the prediction of KACO in the leadership compass, you see that the, our, the market of the Palm is expected to grow at an average growth. At 20%, we start at 2.2 billion this year, we are going more than double in 2025.

Why that, because of the transformation, because also of the necessity to comply with many, many, many regulation, which is very important for organization, we want to demonstrate that they have done the necessary thing to, to comply with the regulation. And they are safe of course, to cope with more and more cyber crimes and so forth. And so on by the way, hackers are very well understood that the most easy to go route to, to, to attack an organization is to go via privileged accounts.

So the protection of the privileged account is very, very important, so more and more privileged accounts, more and more assets to protect and more and more privileged usages need for a global plan solution. So regarding the vendors, vendors are increasingly enriching their offers. So they are moving from usual standard features in the vaulting password, etcetera, to more high highend features like P users analytics. They are more and more introducing the risk approach in the solutions.

And we are all working in our fields to make our pump solutions more into advance threat protections with scenarios of automation in order to corporate the most advanced situation. But the important is elsewhere. The important things is regarding the Pam challenges themselves in terms of project and deployment and adaption. We have four key challenges for the Palm that, that we look at when we are discussing with our customer. When we are deploying program, we are first is the deployment. Second is to work with the adaption. Third is to implement the principle of least privilege.

And the fourth point is to ensure that you can cope with a, a fair total cost of ownership, a competitive cost of ownership. Let's look at this at those challenges. One by one, the first one is deployment. When we are talking about deployment, the more important thing is to be aware that you need to plan your solution, your people well, before you acquire a solution, you need to make sure that the solution that you are going to acquire will fit into your infrastructure well easily.

And you need to ensure that your processes, your plan processes, or will fit into your it processes very well and very easy. This calls for progressive planning. And when you have done that, one of the first and important topic to do is to identify the assets, the accounts, and the owners that your pump solutions is going to be obliged to manage in order to ensure that you have a global reach in terms of security. When you have some assets, accounts, or owners who are not identified in an organization, this, if you leave this, then you are almost sure that this threat will be discovered.

This, this, these weaknesses will be discovered and that threat will come to it. This is a global and complex timing process. And of course, it's better to go with, with some, some professional to accompany yourself. There are a lot of people who try to do it themselves. It's dangerous because you have a lot of things to think about and processes to let's look at that from a, from project project.

If you look at the solution that can address your diploma challenge, a good approach is to choose a modular solution, a solution, which is able to work at the session management level without a password management level, for example. And then you start with the session management implementation. You increase with an access management in order to cope with remote access, and then you can implement password management.

And you also can choose solution that are going to have an integration with external vault or your own vault in order to ensure that if you have invested in the vault previously, and that you want to move to another solution, you can keep your vault and improve your solution. This goes for a control project, timing and implementation with this kind of solution. You control timing. This enables also demonstrates results very early in the process because you don't need to deploy a global solution. In order to show results, session management would be a first step, very efficient first step.

And then you can expand your offering or your, your project with PDM with end endpoint. We see that scale at the level you want when you want at the time.

So again, this kind of planning calls for planning think preview prior to, to, to buy decision. And this enable you to control your implementation and to demonstrate results very quickly.

Second, at the challenge in the Palm is the adaption here. You need to ensure that the user are going to be using the product, using the pump solution with no, not much friction.

And you, you should expect some friction when you implement some pre management solution, because you are going to ask your users to modify their habit. Here. We are speaking about change management. We need to prepare people. We need to explain them the reason why you need to implement this access management solution, and then how the solution can help you is with very, very graphical interface to ease, to ease the work of the users, not putting an additional burden on them. Progressive deployment is also a key.

And again, how the solutions are going to help you with modular architectures. So if we come back to our model here and you start with solution, which are very model, again, you can start with session management and then you start with the solution. You don't need to start with session and password management, for example, and you, you, you implement the session management, you control record sessions, privileged sessions. So this enables you to be compliant. Then if you want, you can add an access manager interface in order to connect for the, to do the external world.

And then you leave the project. The project as is working and people are going to, to get used to the session management. Then in the second step, you can implement password management. And here you are going to discuss with your users because there is the moment where you are going to change their habits because they are, they are going to need to forget about their old password habit. And it'll be much more easier because they will have been used to use the session. And then again, you can scale whenever you move.

So again, coping with a adaption challenges needs with, for, for modular or modular solutions and, and solutions can help you to do that. Very, very easy. Third challenge of the pre edge access management is to implement the principle of least privilege. This principle states that in an ideal world, every user and application must be able to access only the information and resources that are necessary for legitimate purposes. That means that you need to ensure that the right person should access the right resource at the right time and for the right purpose. What does that mean?

First, as we have seen, we will have more users than ever in our infrastructure. Of course, we'll keep with it. Administrators, privileged user management users, but also any user who has access to sensitive information can virtually be a privileged user.

So this means to expand the user scope to any user who could be a P a user, the second, the second point, the resources, not only are you going to implement the management to servers and critical it infrastructure assets, but also to the endpoint and sales in order to remove the privileges admin account from the endpoint and to secure your solutions in automatic way. So the principle of this privilege is a challenge because it's enriches a lot, the protection, and it's important to implement it in the second step.

Once you have a privileged access management solution, but if you combine this with a just in time approach, then you have a very powerful global end to end solution that I would like to say, for example, that you have an administrator who needs access to a firewall to upgrade its firmware for 1 22 hours. He believes that he needs to be the access for two hours.

So he opens his interface and he requests the best, the approval to the, the system, the approval system to the authority, whether it is a supervisor or, or, or, or a system that works with the, the, the P access management P we'll tell him, okay, you have the access, but only for 60 minute, because I know that to, in order to upgrade the firmware, you don't need two hours, but only one hour.

So he will get access to the resource for let's say, 60 minute only, but when he has access to, to do to the resource, doesn't mean that he can do the firmware upgrade, because this is a very sensitive operation. So he will need to ask to another authority or the same authority, the authorization to make an upgrade of this firewall framework somewhere. And this means that the system will escalate his, his privileges in order to enable the administrator to do this operation.

When the operation is done, then the system will remove both accesses and privileges for this user, meaning that he has no anymore access to the resource. So this implementation is extremely powerful in order to grant that the right user has access to the right resource for the right purpose and for the right duration, no standing access anymore, and no standing privileges. This is very important and powerful in order to implement this, this, this threat protection. The last management challenge is the total cost of ownership.

When you plan a project, you need to encompass all the costs of the project and to choose solutions, which will minimize the global total cost of ownership of the pre.

We are speaking here about setup costs and running costs, both meaning that you need to think about it on a given duration, a given project duration, for example, the time between today and your next global upgrade or your next geographical expansion, you of course need to take into account the number of users that you're going to, to, to use, to use the solution you are going to take to code for the number of the resources that you want protect, but also the number of modules and servers that you're going to need in order to improve the solution.

And also the number of environment that you want to, to deploy the previous access management solution on production environment, pre-product environment or testing environment. And then of course the price of the license and the price of the project. If we look at various simulation that we have made, you can see here, the split between the setup costs in blue, orange, gray license infrastructure, and project costs and the running costs.

And you can see that this share of running costs, maintenance administrations is between 24% for, let's say, large, medium to large project up to 55% for smaller project. And this is very important to take into account in order to ensure that you are planning your total cost of ownership very carefully, and that you are minimizing the, the, the total cost of the, of the solution. When you are going to, to, to develop this knowledge and to understand the total cost of ownership methodology, you can see a lot of differences between several solutions in our, what is simulations and method.

We will, our methodology. We observe some difference between three 30% between different solutions, because as always, you can see differences in the running phases because of the simplicity, the different simplicity and modularity of the various solution. So it's important to discuss with the vendors and to challenge us, to challenge our solution, to challenge our models and discuss with us in order to ensure that you are keeping the solution, which is going to minimize your total cost of ownership on the setup, and also on the running of the solution.

This is almost the end of the presentation. I just would like to show you what values are.

So we are, as you know, probably a leader in the British access management solution, we have solution which are certified at the, at the level security and privacy by design are part of our DNA. And as well, probably understood our solutions are designed and developed to make easy the life of our customers. Alexei. It will be my conclusion at the glance is a global company with 170 plus employees, more than 1000 customers. And more than one year partners, we are deployed all over the world and we serve our customers with total customer ownership, management, simplicity, and easy to use.

Thank you very much.