topic Re: Privilege Access Management and its effect on enterprise GIS in Esri Software Security & Privacy Questions

Privilege Access Management and its effect on enterprise GIS

AlisonGaiser1 — Tue, 04 Jun 2019 17:24:22 GMT

We are about to embark on a project to implement Privileged Access Management (PAM) in order to improve the control, reporting and audit capabilities related to administrator/privileged accounts. This will include service level accounts that are used to run background tasks on our servers. Has anyone had any experience with the use of a PAM in relation to their enterprise GIS System? What impact has the PAM had on python scripts or other scripts that you might run using a service level account? Would appreciate any feedback you might have.

Thanks,

Alison

Re: Privilege Access Management and its effect on enterprise GIS

RandallWilliams — Tue, 30 Jul 2019 18:07:22 GMT

In 10.8, we're moving to an option to support gMSA out of the box. While PAM and gMSA serve very different functions, gMSA is a good solution for service accounts - especially when paired with a PAM solution for auditing. ArcGIS Enterprise currently supports GMSA, but only after the installation process is complete. Beyond that, I don't have specific customer experince to share regarding PAM and ArcGIS impacts.

https://support.esri.com/en/technical-article/000021125

Re: Privilege Access Management and its effect on enterprise GIS

Eric_JS — Mon, 24 May 2021 21:21:00 GMT

Alison: Our IT dept is implementing PAM thru SecureONE. Any problems with your implementation? Any advice?

Thanks,

Eric

Re: Privilege Access Management and its effect on enterprise GIS

KevinHofmann — Fri, 25 Mar 2022 11:57:19 GMT

Our IT is considering a PAM solution as well. Anyone have advice and/or using it successfully.

Thank you,

Kevin

Re: Privilege Access Management and its effect on enterprise GIS

BryanGillis1 — Tue, 01 Aug 2023 16:28:04 GMT

I've recently been made aware that our new cyber security chief is going to be pushing PAM (via BeyondTrust) on all developer machines. I am a one stop GIS shop for an organization of about 15k. I utilize AGOL and enterprise depending on target audience/data sensitivity. I have only been able to keep pace with demands via near-constant automation of processes. I am concerned about the new cyber security methods impacting that automation. I was wondering if anyone in the community has had success navigating a PAM implementation while still pushing and pulling through a plethora of external and internal sources in an automated manner. Or am I just the next in line to hear the chorus of crickets? 😅

Thanks,

Gillis

Re: Privilege Access Management and its effect on enterprise GIS

RandallWilliams — Mon, 07 Aug 2023 13:54:12 GMT

In a future release, we'll be offering a headless token approach that should ease some of this challenge. That will allow for mandatory MFA for user accounts along with the ability to use "service accounts". ArcGIS Enterprise now supports gMSA out of the box.