What is a one sentence summary of your feature request?
Introduce policy-based Step-up Authentication for sensitive credentials and security-critical actions, including re-authentication through MFA such as push approval.
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
We would like to request an additional security capability for Netwrix Password Secure: configurable Step-up Authentication.
Currently, multi-factor authentication is primarily performed during login. Once a user has an authenticated and active session, the user can access credentials for which permissions have been granted.
For particularly sensitive credentials, administrators should be able to require fresh authentication before specific actions are allowed.
Examples include:
Revealing a password
Copying a password
Autofilling highly sensitive credentials
Accessing administrative or privileged accounts
Exporting credentials
Starting security-critical RDP or SSH connections
Administrators should be able to assign Step-up Authentication policies to:
Individual credentials
Organizational Units / folders
Tags
Forms
Security classifications
Roles
Users or user groups
An additional Authentication Freshness Policy would be useful.
Examples:
Existing MFA authentication is sufficient
MFA must be less than 60 minutes old
MFA must be less than 15 minutes old
MFA must be less than 5 minutes old
Fresh MFA is required for every access
A particularly user-friendly option would be push-based authentication.
Example:
“User X requests access to DOMAIN\Administrator”
Actions:
Approve / Deny
Optional number matching should be supported to reduce accidental or fraudulent push approvals.
The functionality should preferably not be limited to one specific provider such as Duo, but should be able to use supported or configured MFA providers.
All Step-up Authentication requests, approvals, denials and subsequent credential access should be recorded in the audit log.
Security benefit
A compromised or unattended active Password Secure session would no longer automatically provide access to every highly sensitive credential available to that user.
This introduces an additional security boundary between:
“The user has a valid Password Secure session.”
and
“The user is currently authorized to access this highly sensitive secret.”
How do you currently solve the challenges you have by not having this feature?
Sensitive credentials can currently be protected through permissions and other protection mechanisms. However, there is no comparable convenient mechanism for requesting fresh MFA authentication directly when accessing an individual sensitive credential or performing a specific sensitive action.