Privileged identity authentication based on user behaviors

A method of accessing an endpoint, comprising:

• receiving, from a privileged user, a request for a credential for accessing the endpoint;
• forwarding, by a privileged identity management client, the request for the credential to the privileged identity management server;
• sending, by the privileged identity management server, a request for a risk score with respect to the privileged user, to a user behavior analytics device;
• receiving, from the user behavior analytics device, the risk score, wherein the risk score is calculated based on at least one action performed by the privileged user for an impending privileged session and at least one action performed on the endpoint by the privileged user during one or more previous privileged sessions;
• if the risk score is lower than a first predefined value, providing the credential, by the privileged identity management server, to the privileged identity management client, and accessing the endpoint by the privileged user through the privileged identity management client.

A system for accessing an endpoint, comprising:

• a privileged identity management client, configured to receive a request for a credential for accessing the endpoint, from a privileged user;
• a privileged identity management server, configured to receive the request for the credential forwarded by the privileged identity management client;
• and
• a security information and event management system, including a user behavior analytics device, configured to calculate a risk score based on at least one action performed by the privileged user for an impending privileged session and at least one action performed on the endpoint by the privileged user during one or more previous privileged sessions;
• wherein if the risk score is lower than a first predefined value, the credential is provided from the privileged identity management server to the privileged identity management client, a privileged session is established between the privileged identity management client and the endpoint, and the endpoint is configured to be accessed by the privileged user through the privileged identity management client.