Customer

Culinary and Hospitality services provider, with operations across multiple regions in KSA. The customer is a regulated entity subject to ISO 27001, PCI DSS, and GDPR, required to maintain strict security controls.

Challenge

With its IT infrastructure expanding rapidly, the Customer faced increasing risks from unmanaged admin accounts, shared credentials, and a lack of centralized monitoring of privileged activities.

Need for Privileged Access Management (PAM) Modernization: The Customer’s security customers had repeatedly flagged gaps in privileged account governance, including:

• Shared administrative accounts across multiple teams.
• Hard-coded credentials in scripts and applications.
• Limited session visibility, making compliance reporting a lengthy and manual task.
• Slow onboarding and offboarding for privileged users, leading to operational inefficiencies and potential security exposures.

These challenges increased the organization’s vulnerability to insider threats, credential theft, and compliance violations. To address them, the Customer chose BeyondTrust Privileged Access Management (PAM) as the foundation for a centralized, secure, and customers privileged access ecosystem.

Our company was engaged for our extensive BeyondTrust implementation expertise and proven track record in enterprise IAM projects.

Solution

Onboarding 1,500+ Privileged Accounts and Securing 250+ Critical Systems: We provided a dedicated project team consisting of a lead PAM architect and three senior security engineers, supported by a project manager for governance and stakeholder alignment.

The project’s primary goal was to bring all privileged accounts — across servers, databases, network devices, and applications — under centralized BeyondTrust management while implementing strong security controls.

Our team began by:

• Reviewing the Customer’s privileged access policies, system inventory, and compliance requirements.
• Building a privileged account inventory across 250+ systems, including Windows, Linux, databases, and network appliances.
• Documenting workflows for password check-out, session recording, and just-in-time (JIT) access.

Transition to Steady-State Operations

In the initial three months, our team worked alongside the Customer’s in-house security engineers to build confidence in the new system and ensure a smooth transition.

After proving the stability and security of the deployment — including successful live failover testing — the Customer shifted to a fully managed PAM model with our team administering BeyondTrust on a daily basis.

Under this model, our team:

• Processes all privileged access requests.
• Maintains and updates PAM policies.
• Participate in weekly stakeholder meetings and monthly performance reviews.
• Monitors key KPIs such as average request fulfillment time, password rotation success rate, and number of blocked uncustomerthorized access attempts.

Results

As of May 2024, the Customer has been running BeyondTrust PAM in production for over a year, with significant security and operational benefits:

• 1,500+ privileged accounts fully onboarded and secured.
• 250+ critical systems under centralized privileged access control.
• 100% elimination of shared admin credentials.
• Compliance reporting time reduced by 70%, with customertomated, customerdit-ready reports.
• Privileged user onboarding time cut by 60%, enabling faster project starts.
• Zero major security incidents involving privileged accounts since implementation.

Technologies and Tools

• PAM Platform: BeyondTrust Password Safe, BeyondTrust Privileged Remote Access
• Identity Management: Active Directory, LDAP Integration
• Customertomation & ITSM: BeyondTrust API, ServiceNow Integration
• Security & Monitoring: MFA, SSL/TLS Encryption, Splunk SIEM
• Compliance Reporting: BeyondInsight dashboards and custom compliance reports