This week’s Blog revisits one written in 2020. The focus being on alerting Security Administrators and other interested people when particular passwords, or credentials, are accessed.
But first to recap, Passwordstate uses the concept of a Password Record, that contains amongst other things a username and password combination. It can also contain a URL, a description, an expiry date etc.
Password Records are contained within a Password List. Think of this as a logical grouping of like Password Records, an example being all website Password Records for accounts associated with purchasing IT equipment and consumables. You could then have different Password Lists for different types of purchasing, such as catering and office consumables etc.
Next, we have Folders. Folders allow you to organize your Password Lists in a meaningful way. This could be based on your organizational structure or using an activity based approach. The example here could be all Password Lists used by IT System Administrators, stored under a folder called System Administrators, as opposed to those used by IT Desktop Support, stored under Desktop Support.
This approach of Password Records, contained within Password Lists, with like Password Lists being stored in Folders, provides a degree granularity that makes assigning permissions to those Password Records logical and easy.
Password Record being Reported:
We’re using an example here on how to report on specific Password Records being accessed. In this example we’ve got a fictious Password Record for our primary banking account.
This is already protected by applying permissions on the Password List and Folder, but as this is an account that provides full access to our bank, we absolutely want to know when it’s being used.
Below is the screenshot of the fictious account,
Scheduling the Report:
Next, we’ll setup a Scheduled Report that runs once every 5 minutes. This report will only generate and send an email if the password for ClickStudiosAccount has been accessed. If no one has viewed or used the password record then no email will be generated. This prevents false positive emails and helps to focus your attention when one containing real information is received.
First, navigate to Reports->Scheduled Reports and click on Add Report as show below;
When Adding Scheduled Reports, on the report settings tab give it a Report Name and a Report Description (optional), but importantly make sure you CC in a user or an email address of your choice in the CC Report To field (image below).
The report is sent to the person creating the Add Scheduled Report by default, but it will also be CC to the email address specified. Ensure you tick the option to not send the report if no results are produced (to stop the false positives), and then choose the report type as Custom Auditing Report.
Next, on the schedule tab, select the frequency of One Time, click on the Generate report and specify a frequency of 5 Minute(s) (image below);
Then, on the auditing settings tab, select the Password List where the password is located, the Activity Types you wish to check for, Query Previous for 5 minutes (of auditing activity), and enter the unique value you set in the Description field of the Password record, then click on Save Report;
With Activity Types you can select more than 1 (one) type. In the example we’ve selected the following Activity Types,
- Password Copied Between Lists
- Password Copied to Clipboard
- Password Retrieved
- Password Screen Opened
- Password Viewed
Note, the Activity Types are directly related to Auditing Events.
Receiving The Report:
The report will now run every 5 minutes, and on finding any entries matching the Activity Types selected, will email the person that setup the Scheduled Report as well as the email addresses specified on the CC line.
The report will contain each of the matches that occurred during the 5 min time interval stated (image below),
