How to bring security and accountability to Privileged Access Management

[MUSIC PLAYING] My name is Damiano Tulipani. I am the Vice President of Cybersecurity at Investors Bank. The bank's been around for more than 90 years. It is a retail bank within the New Jersey and New York area. We are about 150 branches. Throughout the metropolitan area, we have about 2,000 users. And out of those 2000 users, 50% of those users are in our branches. Some of the things that, as a security manager, keeps me up at night is making sure that our controls, our technologies really aligned with our processes. The amount of privileged accounts that were being used on our network as we discovered them, they were legitimate accounts. But we just didn't have a way of really managing that privileged account. We wanted to make sure there was accountability, traceability. We wanted to make sure that part of the process would be to even record some of the sessions based on the criticality of the application or the server that the privileged user is accessing at any given time. We assembled a core team. And I think that was so instrumental because we had everybody involved from the very beginning. And what this core team represented was just that the businesspeople that needed to make that decision, including IT and Information Security professionals. One of the members of that core team was Audit. Safeguard was the tool of choice. And looking at this new, next gen product that really was going to align with our focus and really our business strategy to move forward. So some of the processes that we're going through right now with Safeguard is making sure that these accounts are being managed properly, where we know who has access to them and we can attest to them. When we think of PAM, people think that you just put it in and then you're done. No, PAM is continuous Privileged Access Management is going to be a long life journey. So privileged access management, it's extremely important because we need to know who has access to the ID and when do they use it? Why do they use it? And why are they using it outside of business hours, as an example. So for us, it's important to really know when that account is being used and how it's being used. Safeguarding is extremely important for Investors Bank. It's just the automation, the capabilities that it has. It's allowing us to really automate a lot of processes. For example, one of them is our Joiners, Movers, and Leavers process. We're able to take that process and have Safeguard manage that password. So whenever it is an action that's executed by our HR partners and they submit a request for a Joiner, which is a new hire, or a Mover, which is a recurring employee that's moving over to another department, or a Leaver, someone that's leaving the bank, that process, it's totally being managed with Safeguard and that password is never static. It's always changing. So everytime the process is running, we're ensuring that that password is getting flipped. The benefits of having a next gen tool is extremely important to us and exciting at the same time because we know for a fact that we're going to be able to automate a lot of the functions at the bank. So when we talk about identity and security, we have to know, from a business perspective, how is that going to compliment the growth of the organization? So talking about that, we really know who has access to that account. So I'm really excited to see what's coming down on that roadmap to Safeguard and how we're going to be able to do bigger and better things with this product.