Lending Solutions, Inc. Leverages Centrify to Implement Emergency Remote Access for Privileged Users While Maintaining PCI Compliance
LSI leverages technology to assist millions of families around the US with their financial inquiries and concerns on behalf of the company’s financial services clients. Centrify was the only effective, fast solution LSI had readily available to quickly enable the majority of their agents to work from home during the COVID-19 health crisis. Centrify delivered all the core elements required to keep the business up and running in a PCI compliant manner and helped LSI to maintain the health and personal safety of their employees. Read Case Study
Because LSI serves financial services institutions, it’s considered an “essential” business and was required to stay open during the COVID-19 shutdown. But employees were nervous. Social distancing was implemented to the greatest degree possible, but in a call center, that proved difficult. Vice President of IT Dan Boutin began working with his team to discover how they could get their agents safely and productively working from home with the resources they already had on hand.
LSI had a remote workforce strategy in place, including a work-from-home solution with around 75 home-based agents using a VPN connection over a business-class ISP and two-factor authentication. While the setup was effective, it couldn’t be scaled fast enough in a mass deployment situation.
The company needed to get approximately 400 more agents working from home so they could continue to be productive, without the risk of spreading the virus in a close-quarters office setting. At the same time, the solution would need to meet stringent PCI compliance mandates, which are particularly prescriptive in terms of privileged access.
With Centrify already in the LSI environment, extending its capabilities to enable secure remote access seemed like the best course of action. Time was of the essence, so Boutin staged an executive team call and pitched the Centrify solution. “The execs were instantly on board,” he says. Next, he suggested the Centrify solution to the company’s PCI QSA auditor. “He also approved it, and that made it a slam dunk.
The Project Drivers
- Continue to be more productive, while 400 more agents are suddenly working from home due to COVID-19, without the risk of spreading the virus in a close-quarters office setting.
- Maintain compliant with both PCI and EI3PA
- Create an automated way to manage access to client’s banking systems that didn’t use generic passwords
Lending Solutions Inc. leveraged the following Centrify Zero Trust Privilege capabilities to achieve their objective.
Shared Account & Password Vault
Privileged Access Request
- Secure Remote Access
In response to the COVID-19 virus, LSI called on Centrify to provide remote access for privileged personnel, while remaining compliant to the same regulations. Agents are currently using Centrify Identity-Centric PAM to work remotely. LSI set up a remote desktop through Centrify that allows its agents to access the same environment they have in the workplace. It was quick to set up and the company has maintained compliance with all the regulations and standards they follow.
“Centrify was the only solution we had readily available to quickly enable the majority of our agents to work from home. We were in a pinch and we needed an effective, fast solution. The time-to-value was everything we could have asked for. And our agents are grateful that we put the time and effort into keeping them safe,” says Boutin.
Centrify was the only path we had available to get our agents working from home and maintaining PCI compliance. Using Centrify as a pandemic work-from-home solution was a totally unexpected benefit that we’d never even considered when we purchased the solution., Vice President of IT, Lending Solutions, Inc.
A Look Ahead
Looking to the future, Boutin is considering leveraging the Centrify PAS as a secrets vault to provide LSI’s internal developers with ephemeral tokens rather than less secure, static passwords. And he’s evaluating the solution’s session recording capabilities. “We have jump-boxes that we’d like to have recorded when they’re accessed for production,” he says. The Centrify Audit and Monitoring Service monitors privileged activity centrally at the jump-box level (for remote login sessions) or on each individual system for more fine-grained visibility.