Endpoint Privilege Management (EPM) Architecture

Endpoint Privilege Manager (On-Premises) Overview

Securden EPM is available as a completely self-hosted, on-premises, software only solution and is available as a binary-package for installation on Windows servers.

The package contains everything needed, and you don’t require any other hardware or software. It comes with an inbuilt web server and PostgreSQL server as the RDBMS. Optionally, you can use MS SQL Server as the backend database. You do not require multiple hardware servers for product installation.

The solution runs on a central server connected to a backend database. The server handles all business logic. End-users connect to the server using any standard web browser or make use of the Securden Agent installed on their own endpoints.

Solution Layers

The solution is built with an architecture of two distinct layers. The application layer handles business logic and manages queries and requests from users (agents). This layer includes the primary and secondary servers that handle incoming traffic and manage operations. The secondary servers are prescribed for configuring high availability, load balancing, and for supporting distributed deployments.

The database securely stores system data and details of associated assets in the encrypted form. It handles and processes all write operations in the database.

Securden Endpoint Privilege Manager On-Premises is deployed as a single solution comprising the following modules.

1. Endpoint Privilege Management (Windows, macOS, and Linux)
   Eliminates local admin rights and dynamically elevates applications for standard users in compliance with the principle of least privileges through Just-in-Time, just enough access.
2. Application Control
   Controls which applications users are allowed to execute on their endpoints through allowlisting (explicit trust) and blocklisting (implicit trust) policies.

Product Components and Architecture

The architecture diagram encompasses all the components users and administrators will interact with when using Securden Endpoint Privilege Manager to avail privilege management, application control, and secure remote access capabilities on Windows, macOS, and Linux devices.

The components are explained below:

1. Application Interface
2. Securden Agent
3. Load Balancers

×

Application Interface

The Endpoint Privilege Manager web interface can be accessed by Administrators and Users using any standard web browser. Users and administrators can be onboarded from Active Directory, Entra ID, Google Workspace or created manually.

User accounts on endpoints can be automatically imported into endpoint privilege manager using the Securden Agent. Deploy the agent on all the required endpoints using GPOs, Configurations Manager, Intune, PDQ Deploy, or any similar tool.

Securden Agent

This is the primary interface for users on endpoints. The server creates unique keys for each agent deployed on endpoints. This key is used to authenticate the agent every time the agent queries the server.

Users fetch latest changes from the servers, raise requests, and avail offline access using the Securden Agent. The Agent communicates with the endpoint privilege management server to get the latest policies, monitor requests, and configurational changes.

The policies created in the server are enforced by the Securden Agent on applicable endpoints.

Load Balancers and High Availability Setup

Support for load balancers and high availability are supported out of the box. Any number of secondary application servers can be configured as a redundancy measure to ensure continuous availability of the endpoint privilege management service.

Endpoint Privilege Manager On-Premises Architecture for Distributed Networks

×

For managing large deployments involving multiple disjoint networks using a single dashboard, Securden Endpoint Privilege Manager supports distributed deployment architecture through application servers.

The application servers reside inside each of these networks and communicate with the Securden server through secure channels. The application server has permissions to read and write on the database directly.

The policies created by administrators can be centrally enforced on endpoints across networks seamlessly. Activities are tracked and recorded as audit trails centrally.

Integrations

Securden integrates with your existing technology stack to provide a seamless user experience. Integration with SIEM, MFA, and ITSM solutions are supported out of the box for specific use case scenarios.

SIEM for Centralized Audit Logging

Securden integrates with SIEM tools like LogRhythm, IBM QRadar, Splunk, and Azure Sentinel to share logs related to privilege management and application access.

Multi-Factor Authentication

Securden integrates with multi-factor authentication solutions like Google Authenticator, Microsoft Authenticator, Duo, YubiKey, RADIUS authentication and natively provides Mail OTP, SMS OTP. Securden supports FIDO2 & Web Auth-based Passkeys for secure, passwordless login.

ITSM/Ticketing Systems

Securden integrates with leading ITSM solutions like ServiceNow, Jira, Zendesk, Freshdesk, ManageEngine Service Desk Plus, and SolarWinds ITSM. Requests raised by users can be managed directly from your ITSM interface.

All these functionalities are delivered on a single installation. An installation instance can just have one physical server or multiple application servers as required.

The database columns are encrypted (AES-256) and the database is designed as strictly access controlled. Every installation is guarded by a unique encryption key.

Ports and Protocols Used by Securden EPM On-Premises

Deployment Recommendations

1. PostgreSQL is the default database, while MS SQL Server 2019 or later is recommended.
2. Configure a dedicated SMTP server or an API-based email integration with Gmail or Outlook to enable email alerts and reports.
3. Create a public DNS record that maps the EPM server's hostname to its IP address. Install a public SSL certificate on the application server to authenticate and encrypt connections between user devices and the EPM server.
4. Finally, configure the required firewall rules for database connectivity, communication between endpoint agents and the primary server, email delivery, Active Directory integration, and RADIUS authentication, as applicable to the deployment.