Outcome · Private Access and Remote
Access that closes itself when the time is up.
Most breaches start with a key somebody was given for one afternoon and nobody took back. With Fowlguard, access is given for a stated length of time and expires on its own.
- Who
- Sam Reyes · Contractors
- Wants
- git.internal
- For
- 4 hours
- Reason
- Release branch review
What changes on day one.
Standing access
- Access granted for a task and never removed
- Removing it is a job; leaving it is not
- Admin ports left open to reach consoles
- No record of who approved what, or for how long
Just-in-time
- The request says how long; the approver sets the duration
- The grant is written on approve and removed when the clock runs out
- Consoles reached through a brokered session, not an open port
- Who asked, who approved, for how long and what happened
The approval is the change.
Ask, approve, done.
A person asks for a system and says why. An approver sets how long. Nobody edits a rulebase, and nobody has to remember to close it.
- Who
- Sam Reyes · Contractors
- Wants
- git.internal
- For
- 4 hours
- Reason
- Release branch review
Every grant has an end.
Grants count down in the console and expire on their own. "Who had access to that box in March" is a query.
| Person | System | Approved By | Ends |
|---|---|---|---|
| Sam Reyes | git.internal | Priya Nair | in 3h 12m |
| Ada Moreno | db-staging | Lena Park | in 38m |
| Tom Ilves | build-01 | Priya Nair | Expired |
Being let in is not the same as being allowed to do anything.
A session privilege policy decides what a brokered RDP, SSH or WinRM session may do. Every way data leaves a session is off until you turn it on.
- Clipboard, file transfer, drive redirection and port forwarding, each a switch
| Privilege | Contractors | Engineering |
|---|---|---|
| Clipboard | Off | On |
| File Transfer | Off | On |
| Port Forwarding | Off | Off |
| Screen Recording | On | On |
Your first expiring grant.
Just-in-time access is part of the Medium plan.
Publish the system
Add the server with a licence key, or reach it through a Router.
Let people ask
People request access with a reason and a duration.
Approve for a time
The grant is written when you approve and removed when the time runs out.
Medium · $10 per user per month
Who decides how long access lasts?
The request asks for a duration and the approver sets it. The grant ends on its own when the time is up.
Is there a record?
Yes: who asked, who approved, for how long, and what happened in the session.
Which plan includes it?
Just-in-time access is included in Medium, at $10 per user per month for Private Access.