BeyondTrust Privileged Remote Access lets you control, monitor,
and manage privileged users access to critical systems.
As part of our privileged access management platform,
Privileged Remote Access enables secure remote access
for internal administrators and third party vendors.
For internal administrators,
it gives a more secure way to access systems while improving
productivity at the same time.
It also lets you bring contractors and third party
vendors into your organization safely without the need for VPN
and traditional all or nothing remote access tools.
Finally, it enables centralized control over remote access sessions and
complete visibility into session activity through screen
recordings and session forensics.
Now, let's take a look at how Privileged Remote Access works.
To begin, IT administrators vendors or guest technicians log into the product.
As indicated by the green arrows,
all traffic is four forty three outbound to the appliance.
There's a reason for this.
Firewalls are designed to block incoming traffic.
That's why traditional remote access tools, like RDP, VNC and Daimware,
require firewall configuration changes in order to work over the internet.
But with BeyondTrust,
both the privileged users and the endpoints connect to the
appliance, through outbound connections.
So no port forwarding or firewall changes are necessary.
When a privileged user logs into the product,
you can have them authenticate using a local account and our
built in ToTP for two factor authentication.
Alternatively, you can also utilize various combinations of active
directory, LDAP, SAML, or radius connections.
Once logged in, the user will inherit group policy,
which is also managed within the appliance.
This lets you that a user only has access to the endpoints you
want them to access with the features you want them to use.
With BeyondTrust jump technology,
users have a variety of ways to access endpoints.
One common method of remote access is the use of jump clients.
A jump client is an agent you deploy to the application layer of an endpoint.
It runs as a service and works on Windows, Mac, Linux,
and headless Linux rating systems.
Jump clients are especially effective when the network is unknown.
Jump clients send an outbound heartbeat ping to the appliance
about every ten seconds,
checking both for software updates and connection requests.
If a privileged user initiates a connection request,
that opens up a TLS encrypted session between the jump client
and the appliance.
Then the user who's interacting with the is never connecting
directly to the endpoint itself.
Instead, every interaction is happening on the appliance.
In addition to this agent based approach,
privilege remote access includes an agentless
methodology using a jump point.
A jump point acts as a conduit for remote access to systems on
a known work.
With this method,
a single node is used to access multiple systems on the network,
eliminating the need to pre install software on every
computer you may need to access.
Like the jump client,
the jump point sends an outbound heartbeat ping to the appliance,
waiting to be contacted to make an outbound call to the
appropriate system.
As the yellow arrows here indicate,
the jump point can utilize protocols like RDP protocol
tunnels, web jumps, SSHH and telnet, or VNC.
Once the jump point has made the outbound connection to the system,
It then delivers that session securely back to the appliance
over the TLS encrypted connection.
As with the jump client method of connecting,
jump points also allow the privileged user to interact
with each system on the appliance.
So even though administrators may be connecting using a legacy protocol,
they're never actually connecting directly to the
endpoints themselves.
With this method of connecting,
each session can be fully audited and screen recorded,
and these logs and recordings are stored on the appliance in
a tamper proof manner.
Finally, privileged remote access eliminates the need for
privileged users to remember or share credentials for the
systems they need to access.
Passwords can be stored in the on appliance vault,
or you can integrate privilege remote access with BeyondTrust
Password Safe or another password management solution.
This password component enables our credential injection capabilities.
Instead of requiring its users to no usernames and passwords
for each endpoint, we can store those credentials securely,
and then using API functionality we can retrieve
those credentials and inject them directly into a session.
This means you don't need to expose credentials,
giving you more control and flexibility around his accounts.
Now let's jump into the product itself.
When a user logs in to Privileged Remote Access,
They'll see a list of the endpoints your group policy
allows them to access.
You can filter in points by groups,
or you can select my jump groups to see the complete list.
And you can view properties of the jump shortcut to see more
about the endpoint.
This one, for example, is a Linux server, which I am able
to access through a jump point on a remote network using SSH or shell jump.
Administrators can modify most of these properties.
With this endpoint, for example,
I can select which jump point I wanna use.
I can also apply a session or jump policy to this endpoint.
Session policies let you customize the security
permissions within a session to fit specific scenarios.
And jump policies are used to control when certain jump items
can be accessed by implementing schedules,
whether notifications are sent when a jump item is accessed or
whether approval or a ticketing system ID is required before
jump item can be accessed.
In this case, I wanna make sure the end user gets permission before
accessing the endpoint.
So I'll select the SIS ops approvals policy.
This is going to send an email to someone in my data center
asking them to approve my access.
So not only can you centrally manage users access the system
you can use workflows and policies to further refine that excess.
Now, when an end user double clicks on that jump item,
They're presented with an authorization request window.
Here I can see who the approver is and other information about the policy.
I'm also prompted to provide some justification for
accessing the system,
as well as the date and time period I'll need to have access to it.
This can be helpful if you have administrators working on
systems over a weekend, for example.
I'll see a pending status as I wait for someone to approve my
access or quest.
Once it's approved,
I'll get an on screen notification and possibly an
email notification, and I'll see my status change.
This time when I double click the endpoint,
I'm not prompted to provide justification,
but I am alerted that someone will be notified about this session.
This endpoint requires credentials to be entered
before I can access it because we're either using the built in
vault capability or we've integrated with an
external password safe.
I'm able to access the Linux server with these credentials,
even though I don't know what they are.
So I click okay and privilege remote access pulls those
credentials from our password management system and enters
them in on the remote system allowing me to log on This is
BeyondTrust credential injection capability.
Once connected, I noticed that my approver left me a message for him to contact
if I have any questions.
So I'll acknowledge that and launch into my SSH session to
this Linux server.
Now, I'm connected to the endpoint through a jump point proxy.
I can work on it just as I would through a traditional putty session.
But with beyond trust, everything I do can be
recorded, audited, and monitored in real time.
I can also connect to systems using jump clients.
So in this example, I'll select one of our Windows servers.
Once connected, I'm dropped at the login screen.
Again, I don't know the credentials to log in,
but with credential injection that doesn't matter.
Here I'm able to see the list of credentials that are
currently available to me on this machine.
I only need to click the credential I want to use to log into the system.
In addition to remote control and screen sharing,
I have additional functionality on this system.
On the file transfer tab,
I'm able to browse the remote and local file system,
and transfer files back and forth.
I also have a command shell emulator that lets me interact
directly with the command shell without having to open it up in
the screen sharing GUI.
I can view system information without using the GUI two.
This lets me access device manager,
process information, and the ability to interact processes,
I can also see an event viewer, a programs list, and currently
running services.
I even have a registry access tab that gives me access to the
registry editor without needing to open it in the GUI.
Access to all of these tabs is controlled granularly through policies.
So if you don't want a vendor or a sys admin to have access
to a particular tab that can be controlled through the group
policy or through the junk client policy.
I can have multiple sessions running at once and easily
toggle back and forth between tabs,
or I can go back home and launch additional connections.
For my next session, I need to access an internal website.
This particular dashboard does not require a login but you can
use credential injection with web jump if needed too.
This is a BeyondTrust real time dashboard.
And as you can see, there's no one logged in at the moment.
So there's not much activity.
I'm not able to modify the URL.
But I can follow hyperlinks within the page or move back
and forward or refresh as necessary.
Webjump can be especially helpful for securing access to
web based administrative interfaces,
like your administrative console of AWS, for example.
Just like with other session types,
everything I do in this session is being fully recorded and audited.
You can also use Privileged Remote Access to enable collaboration.
Often, organizations need to bring in a number of experts or even
vendors or partners to resolve an issue.
Instead of launching a screen sharing session through some
type of meeting tool,
you can actually invite the user in through Privileged
Remote Access.
To illustrate this,
let's say I'm logged in to this jump client and decide I need
some additional help from a vendor or a third party,
if I had permission to do so, I can invite an external user.
Along with the invitation,
I can specify the level of access they should have and
provide some context for them.
This will generate a URL that I can share with that third party technician.
When they open that URL in the browser,
they're taken directly to the appliance.
Here, they can choose to join through the web access console,
or they can download the full access console.
I'm going to use the web access console and join the session
as that invited user.
The invited user will see a welcome notification.
And once they click okay,
they're interacting with the same technician who invited them.
Just by way of demonstration, here in the foreground,
we have our invited vendor,
and in the background is the original technician.
As the invited user begins troubleshooting,
you can see that everything is happening in real time in both windows.
As long as the original session is open,
the invited user can work on the system.
Or the original user can manually remove them before
ending the session
Once they've been removed,
their access is permanently disabled.
They cannot get back into the system unless we generate
another invitation.
We've mentioned that all sessions can be recorded and
audited, so let's take a look at what those reports look like.
We access all the reporting through the appliance interface.
As with other privileges in the product,
reporting is also a group policy membership item So if
you don't want someone to have access to reporting,
that's not a problem.
You can also delegate reporting permissions.
So if you have a particular vendor who needs to see reports
from sessions on boxes they have access to.
You can let them see those reports without giving them
access to everything else.
There are three main reports available, session reports,
summary reports, and session forensics,
With session forensics,
you can actually search for file names or events that
appear in the session log,
but we're going to run a simple session report.
Once I do that,
I can see reports for the sessions that have been done on the supplies.
We can click details to see the complete session log.
We also have a link to view the video recording of the session.
These recordings are compressed,
so they have a pretty small footprint in terms of storage.
Especially if you want to retain the data for longer
periods of time.
As you've seen, Privileged Remote Access lets you manage access to critical
systems without hindering the productivity of your users.