Phone Number +1-202-802-9399 (US)

ThycoticCentrify is now Delinea!

The Lockdown

Thycotic’s Cyber Security Blog

New Enterprise Ticketing System Integrations Available for BMC Software and ServiceNow in Secret Server

Written by Ben Yoder

October 5th, 2015

The ability to automatically respond to and track Secret Server privileged user activity in enterprise ticketing systems is a huge benefit for our customers, because it removes the manual burden of updating and closing out tickets based on what privileged users are doing within the solution. That’s why the latest update to Secret Server now includes new options for validating access to privileged accounts in Secret Server by ensuring incidents exist in BMC Remedy ITSM and ServiceNow, as well as custom options for other ITSM systems. For current customers, we’ve included a detailed workflow with step-by-step instructions and screenshots to help you make the most out of the new features.

Easy to Follow Workflow and Setup

When a user requests access to a Secret, or enters a comment, there is an option to require the user to also enter an incident or change request ticket number in the workflow.

Configuring ServiceNow Integration

Figure 1 Configuring ServiceNow Integration

From an auditing and control perspective, this is a key requirement; you want to make sure that the user is actually using a privileged account because of a legitimate incident or change request. Previously Secret Server allowed validation of the ticket with a regular expression to make sure it matched a valid pattern.

With the new integrations with BMC Remedy ITSM and ServiceNow available you can ensure that the ticket actually exists in your ITSM system. If a user enters a fake ticket number, or an old number that’s now closed, they won’t be granted access to the Secret. Additionally, you can choose to keep a trail of the workflow audits as comments on the ticket. For example, if an admin requests access to a Secret and puts in an incident number as well as a reason of “Restoring Backups,” their reason shows up on the incident in the ITSM system. This helps bring context to the ticket so users know that it is being responded to and also allows those applications to take advantage of those comment trails in their reporting and auditing.

Powerful Customization Options

While BMC Remedy Service Desk and ServiceNow are industry-leading ticketing systems, there are many more out there. You can build a custom integration by simply using the PowerShell scripting feature in Secret Server. Secret Server can connect to multiple ticket systems, so even if your teams use BMC, HP, and a custom-built system they can all be integrated into the Secret Server workflow. The user just has to pick the target when they add a comment and put in a valid number.

Validating a Ticket

Figure 2 validating a ticket

The customization also lets you extend the integrations with the out of the box systems. If you want to validate the incident state differently, or add comments to a different space, that can be done through the PowerShell scripting.

Integrating with your ITSM application brings more accountability to your audit trails, and can help prevent misuse of Secret Server by ensuring that users have documented reasons why the need a privileged account.


Like this post?

Get our top blog posts delivered to your inbox once a month.