Internal and
External
Security
Compliance
at Adobe
Privileged Session Management
Case Study
“Balabit Privileged Session Management helps us meet a portion of our
compliance and internal security requirements related to access management.”
– Matt Magleby, Sr. Computer Scientist at Adobe.
Adobe gives everyone — from emerging artists to global brands — everything they need to design and deliver
exceptional digital experiences. Adobe is passionate about empowering people to create beautiful and powerful
images, videos, and apps, and transforming how companies interact with their customers across every screen.
The Challenge From a technical perspective, Adobe
The Adobe Experience Cloud business unit had was searching for a solution that:
several internal policy- and compliance-related security
Supports in-line MFA
requirements, such as the ISO 27001 and SOC 2 reporting.
Key requirements included multi-factor authentication Supports SSH and RDP protocols to access both Linux and
(MFA) for accessing production systems and logging of Windows servers
all administrative sessions. So, mainly driven by TCO
considerations, Adobe wanted to consolidate bastion hosts Logs and audits administrative network traffic
into a central access management gateway. For usability
Integrates with existing LDAP user directory
and manageability reasons, Adobe preferred a network-level
solution that does not require installing agents on clients or Supports SSH keys for authentication
servers. In addition, they needed a user-friendly solution that
did not disrupt the daily workflow of system administrators. Can forward user logs into Splunk for long-term storage and
analysis
Provides high availability
“We were looking for a low maintenance and horizontally scalable solution.
We expected that it could be customized to our needs with a high level of
quality and responsiveness from the vendor.”
– says Matt Magleby, Sr. Computer Scientist of the Core Services Team at Adobe.
The Solution
During the selection process, Adobe evaluated virtual terminal-based access management systems and other “all-in-one” privileged identity management
(PIM) solutions as well. However, these solutions did not integrate well with Adobe’s existing identity management infrastructure and would have required
significant changes in administrator workflows. When searching for alternatives, they found Balabit’s privileged user monitoring appliance, the Privileged
Session Management (PSM, formerly known as Shell Control Box).
“We chose PSM because its proxy-based gateway architecture and the easy implementation were important for us. The MFA support, the integration with
LDAP and the least disruption to workflows were additional advantages of the product. In addition, we got a great implementation support from Balabit’s
pre-sales team.” – says Magleby.
After an initial Proof-of-Concept phase, Adobe created a test environment to conduct extensive testing and plan the implementation of PSM. The full rollout
took a few weeks. In the beginning they ran Privileged Session Management in parallel with the existing bastion hosts and eventually decommissioned the
old systems.
Adobe deployed three high availability PSM clusters in three locations. The clusters control SSH- and RDP-based access to Linux and Windows hosts
located in multiple, geographically distributed datacenters and cloud-based environments. Today, PSMs are operational in Adobe’s production environment.
They monitor hundreds of administrative users and help protect tens of thousands of hosts.
Production Environment
Linux SSH RDP Windows
host host
AUTHENTICATION
AUTHORIZATION
AUTHENTICATION
AUTHORIZATION
HOST
HOST
GATEWAY GATEWAY
LDAP AUTHENTICATION / AUTHORIZATION AUTHENTICATION / AUTHORIZATION AD
User Store User Store
PSM
MFA
AUTHENTICATION LOG / AUDIT
OKTA DATA
SPLUNK
MFA
W / OTP
Administrator Corporate Network
PSM-based privileged user monitoring architecture at Adobe
[Link]
Third-party Integrations
Okta
The Privileged Session Management is integrated with identity management service Okta, which supports multi-factor authentication scenarios. Prior
to establishing an SSH or RDP connection the PSM AA plugin framework invokes Okta Verify OTP (one-time password) or PUSH authentication.
This allows Adobe to leverage an additional out-of-band factor (typically through the user’s registered smartphone) when authenticating the user.
The additional factor is processed in-line with the connection setup, so users don’t have to go to an external application to process the additional
factor. This results in an efficient end-user experience that is readily accepted by the users.
Splunk
PSM exports audit data for both SSH and RDP sessions and sends them directly into Splunk using the Splunk’s HTTP Event Collector. This allows
Adobe to leverage Splunk as the aggregator for security-related log data from PSM as well as other applications, hosts and devices. Thus, they
can use their existing SIEM tool for monitoring, correlating and investigating security events with additional critical information that PSM provides.
Benefits About Balabit
The Privileged Session Management helped Adobe to meet compliance Balabit is a leading provider of Privileged Access
requirements for its Experience Cloud business unit by providing multi-factor Management (PAM) and Log Management solutions that
authentication and auditing technology, a core component to gaining SOC2 help businesses reduce the risk of data breaches associated
compliance. Implementing a central, proxy-based access management with privileged accounts.
gateway instead of distributed bastions helped streamline administrative
tasks and decrease support tickets. The enforcement of a second-factor
Founded in 2000, Balabit has a proven track record, with 25
authentication and the availability of session recordings made access of
Fortune 100 customers and more than 1,000,000 corporate
high-risk users more secure.
users worldwide. The company operates globally with
“Balabit Privileged Session Management helps us meet a portion of offices across the United States and Europe, together with
our compliance and internal security requirements related to access a network of reseller partners.
management. Our administrative users readily accepted it as it is not
disruptive to their existing workflows. PSM is a reliable and straightforward
solution, which integrated seamlessly into our existing identity management
Learn more
system and is able to support our needs for both Linux and Windows server
Privileged Session Management homepage
access. Implementation went very smoothly as it did not require any changes
Request online demo
to our network or servers. We are happy with the benefits PSM has been
Request callback
able to provide, and the ease in which we were able to adopt it.” – concludes
Magleby.
[Link]