Contents
What is Privileged Access? What Is Privileged Access Management? Traditional Privileged Access Management Market Definition PAM Functionality Categories Shared account password management (SAPM) Privileged session management (PSM) Superuser privilege management (SUPM) Application-to-application password management (AAPM) Differences in account discovery What are Privileged Accounts? What are Privileged Credentials?Why is PAM Important?PAM Links to Insider Risk and Vendor RiskPAM vs. PIMPAM vs IAMPrivileged Access Management vs. Least PrivilegeTraditional Privileged Access Management Traditional Privileged Access Management in the Cloud What to look for in new Privileged Access Management PAM without password vaults and password rotation......except when you need them for privileged accessPrivileged 3rd & party access centralized Multi-cloud, hybrid cloud and on-prem Autodiscover global cloud instances with PAM Save valuable time on deploying privileged access management Integrate PAM with AD, LDAP & IdaaS
What is Privileged Access?
Privileged access means computer access with higher access rights than those of a standard user in an enterprise. Typically, privileged access is used to maintain, upgrade, and configure critical IT infrastructures, servers, applications, and databases.
Examples include:
-
Root access: Root access provides unrestricted control over an entire system, allowing the user to modify or delete any file or configuration.
-
Administrator access: Administrator access grants broad permissions to manage system configurations, user accounts, workstations, and software installations, usually within specific operating systems or networks.
-
Access to service accounts: Service account access is designed to run automated processes, granting applications or services the necessary permissions to function without human intervention.
Sometimes any access to the command line on a server is considered privileged access, as most enterprise users are only allowed to use applications through their user interface.
Some privileged accounts are operating system accounts with command-line access; other privileged accounts are application accounts with higher privileges (e.g., accounts that can change the configuration of an application).
With privileged accounts, privileged users can access highly valuable targets like the company network infrastructure, medical records credit card databases, software production environments, or government secrets. These accounts are a primary target for malware and other external threats due to their sensitive and valuable contents. Typically a privileged user has access to one or more privileged accounts.
Privileged access may also be obtained through other means. For example, employees with physical access to a computer can usually reboot the computer from a DVD or USB memory stick and perform any desired operations on the computer. Thus, users with physical access may also sometimes be considered privileged users.
As operations in all industries are becoming digitalized and secure remote access is more commonplace, new targets that are considered privileged have emerged.
These include industrial control systems (ICS) in operational technology, network switches in IT environments, and access to company customer relationship management (CRM) databases. The accounts allowing access to such targets are considered privileged as well.
What Is Privileged Access Management?
Privileged access management (PAM) is used to mitigate the threats of credential theft and privilege misuse.
PAM as a concept is an important part of cybersecurity strategy. Its purpose is to control, track, secure, and audit all human and non-human (interactive and automated) privileged identities and activities in an enterprise IT environment.
PAM is a subfield of Identity and Access Management (IAM).
Sometimes referred to as privileged identity management (PIM) or privileged access security (PAS), PAM is grounded in the principle of least privilege, wherein users only receive the minimum levels of access required to perform their job functions.
The principle of least privilege is widely considered to be a cybersecurity best practice and is a fundamental step in protecting privileged access to high-value data and assets. By enforcing the principle of least privilege, organizations can reduce the attack surface and mitigate the risks associated with malicious insiders or external cyber attacks that can lead to costly data breaches.
Privileged access management typically includes a definition of roles for users and granting required privileges, or access rights, for those roles. It also includes distributing user information and access grants to all the devices and systems that enforce access rights in the organization. Furthermore, it usually includes monitoring what privileged users actually do and analyzing their activities to detect anomalies.
Traditional Privileged Access Management Market Definition
Traditionally, the PAM market has been structured around the following features. However, several of these features are specific to a particular way of implementing PAM. Alternative approaches work much better in the cloud.
-
Controlling access to shared accounts. This may be implemented, e.g., by obtaining a password from a vault, using client software on the user's computer, or by using a web portal. Authentication to the portal or client may use for example two-factor authentication or single sign-on (SSO).
-
Providing four-eyes control, meaning that two people must approve the operation, or the other may be monitoring the action in real time with the ability to terminate the session. Sometimes this is also called dual control.
-
Controlling and filtering commands or actions an administrator can execute. This is often implemented as part of privileged escalation controls, similar to sudo.
-
Monitor and record what privileged users do. Optical Character Recognition (OCR) functionality may be used to extract text from images. User's actions may also be passed on to Security Incident and Event Monitoring (SIEM) and analytics systems. Such systems may analyze the operations to discover anomalies and provide early warning about potential breaches. Many systems provide video recordings of users' privileged account activity and executed commands.
-
Traditional systems use randomized passwords for shared accounts and rotate these accounts frequently.
-
Traditional systems use a password vault for storing the current passwords for service accounts and for supplying them to users and scripts.
-
Some privilege management systems provide functionality for managing SSH keys. However, the functionality provided by these products is usually very limited compared to dedicated SSH key management products and does not generally include full implementation of key life cycle management or the necessary functionality for sorting out legacy keys.
-
Providing dashboards, views, and reports to help understand what users are doing in the IT environment.
-
PAM systems integrate with ticketing systems, IT service and support management (ITSSM) systems, and change management workflows.
Privileged access management systems manage credentials for a wide variety of systems, including operating systems, databases, middleware, applications, network devices, hypervisors, IoT devices, and SaaS applications.
PAM Functionality Categories
Analysts typically divide Privileged Access Management (PAM) product functionality into the following categories.
Shared account password management (SAPM)
Managing and rotating passwords and access to them. Many products also manage SSL/TLS keys, encryption keys, SSH keys, and/or other confidential data in their vaults. It should noted, however, that just storing SSH keys in a vault does not solve SSH key management in any significant way.
Some products also save password history to handle restoring from backups and continuously monitor the environment for password changes made outside the solution (reconciliation). Access to shared accounts often involves a request and approval workflow. An irrefutable audit trail is typically kept of any access to passwords.
Sometimes access may be configured to only be possible if there is an outstanding ticket in an IT Service Management (ITSSM) system that requires access. Additional authentication, just two-factor authentication, may also be required before access is granted.
Most critical systems may require another person to watch the session. "Break-the-glass" or firecall functionality may also be supported for emergency access. Nonhuman access may be also be supported, e.g., in combination with AAPM solutions.
Superuser privilege management (SUPM)
Superuser privilege management (SUPM) involves overseeing and safeguarding access to superuser or administrator accounts on computer systems. Key aspects of superuser privilege management include:
- Protecting superuser accounts (such as "root" on Linux or "Administrator" on Windows) which unchecked possess unlimited access and privileges to execute any action on a system. These actions include:
- Read/write/execute any file
- Install/uninstall software
- Modify system settings
- Delete users and data
- Selectively permitting users to execute commands with higher privileges. This functionality is similar to the sudo tool, but is also available for a wide variety of operating systems
- Restricting and managing superuser access by implementing the principle of least privilege. This means limiting the "blast radius", for example by ensuring the superuser can only modify an individual application with root privileges but doesn't get access to the rest of the network or database.
- Tracking, auditing, recording and even live monitoring superuser activities.
- Limiting the availability of elevated privileges by granting them only just-in-time for the session, only for long as they are needed and ensuring automating revocation of privileges after the task is done.
Application-to-application password management (AAPM)
This functionality refers to providing applications and scripts access to passwords stored in a password vault. This is basically used to eliminate hard-coded passwords. However, these products generally suffer from the risk that hackers may use the same functionality to read the passwords from the vault.
Privilege Elevation and Delegation Management
Privilege Elevation and Delegation Management (PEDM) is designed to grant user access to privileged corporate environments on a granular basis.
Privileged Session Management (PSM)
PSM establishes and monitors sessions for multiple systems and records activities in such systems. It also authenticates users (e.g., using two-factor authentication or SSO) and then providing the users access to shared accounts. See PASM for more information about PSM.
Privileged Account and Session Management (PASM)
What are Privileged Accounts?
Privileged accounts refer to user profiles within a computer system that have more permissions compared to standard accounts. These accounts hold the keys to managing, changing, and potentially disrupting systems. For instance, think of employees such as system administrators or network engineers who need extra access rights to perform their roles effectively.
Learn more about privileged accounts here.
Differences in Account Discovery
Privileged access management solutions differ in how they discover user accounts.
-
Some use ad hoc tasks to discover user accounts and devices (e.g., from Active Directory).
-
Concurrent discovery is used by some products to detect changes continuously. They may, for example, poll information from Active Directory and hypervisors. These products may trigger automatic enrollment workflows in the PAM solution.
-
Service account and credential discovery finds service accounts from the organization. The accounts are often scattered throughout the organization.
-
Some provide semi-automated discovery of hard-coded passwords from shell scripts and applications.
What are Privileged Credentials?
Privileged credentials are the keys to accessing sensitive systems and data. These include passwords, SSH keys, and API tokens that grant elevated privileges within an organization’s IT environment.
Passwords are the most common type of privileged credential. They protect access to critical systems like servers or databases. SSH keys provide secure remote access to these systems, while API tokens allow applications to interact with other software securely.
Securing privileged credentials is crucial for maintaining a strong security posture. If compromised, they can lead to unauthorized access and significant damage. Common risks associated with compromised credentials include data breaches, financial loss, and reputational harm.
Implementing multifactor authentication adds an extra layer of protection by requiring multiple forms of verification before granting access. This helps ensure that only authorized users can use these powerful tools tied closely to your organization's digital identity.
Why is PAM Important?
Privileged Access Management (PAM) plays a crucial role in today's cybersecurity. Increasing threats target privileged accounts, making them prime targets for threat actors. These accounts often have access to sensitive data and critical systems.
Breaches of privileged accounts can lead to severe consequences. Data loss, financial loss, and reputational damage are common outcomes. For instance, if malware compromises a system administrator's account, it could disrupt entire networks or steal valuable information.
PAM helps mitigate these risks by controlling who has access to what within an organization. It ensures that only authorized individuals can use privileged accounts and monitors their activities closely. This reduces the chances of unauthorized access and potential breaches.
Compliance requirements also drive the need for PAM solutions. Many regulatory standards mandate strict controls over privileged access to protect sensitive data. Implementing PAM helps organizations meet these standards more effectively.
Beyond security benefits, PAM improves operational efficiency too. By automating privilege management tasks like provisioning and de-provisioning users' privileges quickly become easier while reducing human error risks associated with manual processes.
Moreover, cloud security benefits from integrating PAM into its framework since cloud environments require robust control mechanisms due to their dynamic nature where resources constantly change hands among different teams or departments within an organization
In summary, PAM provides essential protection against growing cyber threats targeting high-value assets through comprehensive privilege management practices which enhance overall organizational resilience against attacks.
PAM Links to Insider Risk and Vendor Risk
Users with privileged access are typically insiders in the organization.
They include system administrators, database administrators, developers, architects, application owners, and IT managers. Most privileged users are insiders who already have access to the organization and its systems. Statistically, most cybercrimes are perpetrated by or assisted by insiders. Thus, controlling and monitoring privileged access reduces insider risks.
Many external vendors and outsourcing partners also have access to critical systems and data. For example, Edward Snowden was a contractor to the US government. In the famous Target breach, the hackers used an HVAC contractor as a stepping stone to get to their actual target.
There are also recent examples of high-impact breaches involving privileged passwords, highlighting the need to adhere to best practices in privileged account management. It is common for IT administration to be contracted to offshore outsourcing partners. Implementing a comprehensive PAM solution that controls and monitors privileged access is an important step in reducing vendor risk.
PAM vs. PIM
Privileged Identity Management (PIM) focuses on managing and controlling access to privileged accounts within an organization. It ensures that only authorized users can access sensitive systems and data.
While both Privileged Access Management (PAM) and PIM deal with privileged accounts, they have different focuses:
-
Scope: PAM covers a broader range of activities related to securing, managing, and monitoring privileged access across the entire IT environment. In contrast, PIM specifically manages the identities associated with these accounts.
-
Functionality: PAM includes tools for session recording, auditing, password management, and privilege management. On the other hand, PIM primarily deals with provisioning roles and permissions to ensure that only authorized individuals have elevated privileges.
When used together, PAM provides comprehensive security controls while PIM ensures proper identity governance. For example:
-
Delegation Management: With delegation management in place through both solutions working together seamlessly.
-
Enhanced Security Posture: Combining these solutions helps organizations enforce strict control over who has access to what resources at any given time.
By integrating both approaches into their security strategy effectively addressing various aspects of protecting critical assets from unauthorized use or breaches becomes achievable for businesses today
PAM vs IAM
Identity Access Management (IAM) is a framework for managing digital identities and access permissions within an organization. It focuses on ensuring that the right individuals have appropriate access to resources when they need it.
Key Differences Between PAM and IAM
PAM, or Privileged Access Management, specifically targets privileged users who have elevated rights compared to regular users. These accounts often include system administrators or database managers with broad access across systems. In contrast, IAM manages all user identities and their general access permissions.
Role of IAM in Managing User Identities
IAM plays a crucial role in handling user credentials, defining roles, and setting up authentication mechanisms like passwords or biometrics. This helps organizations control who can log into their systems and what actions they can perform once inside.
How PAM Enhances IAM
While IAM covers the broader spectrum of identity management, PAM adds an extra layer of security by focusing on privilege management. It ensures that privileged accounts are monitored closely to prevent unauthorized activities. For example, while an employee might use an IAM portal for daily tasks like email access or file sharing, PAM would oversee any attempts by high-level accounts to modify critical system settings.
Combining both frameworks allows organizations to implement best practices in securing both standard user accounts and those with elevated privileges effectively.
Privileged Access Management vs. Least Privilege
The principle of least privilege means giving users the minimum level of access necessary to perform their job functions. This approach limits potential damage from accidents or malicious actions by restricting access rights.
Privileged Access Management (PAM) and the principle of least privilege differ in scope and application. PAM focuses on managing, monitoring, and securing privileged accounts that have elevated permissions within an organization’s IT environment. In contrast, the principle of least privilege is a broader security concept applied across all user accounts to ensure they only have access to what they need.
PAM enforces the principle of least privilege by controlling who can use privileged accounts and under what circumstances. For example, PAM solutions often require multifactor authentication for accessing sensitive systems or data, ensuring that only authorized individuals gain entry.
Combining PAM with the principle of least privilege offers several benefits:
-
Enhanced Security: By limiting privileges and closely monitoring privileged account activities.
-
Reduced Risk: Minimizes potential damage from compromised credentials.
-
Compliance: Helps meet regulatory requirements related to data protection.
However, implementing both strategies comes with challenges such as complexity in setup and ongoing management efforts required to maintain strict controls over user permissions while ensuring operational efficiency remains intact.
By integrating these two approaches effectively, organizations can achieve optimal security without compromising productivity.
Integration with Identity Governance and Administration
Some PAM products come from more general identity and access management vendors. They may offer more general identity governance and administration (IGA) solutions.
Some offer proprietary integrations into their products, increasing vendor lock-in. Others use standards-based solutions, such as Active Directory and Light-weight Directory Access Protocol (LDAP).
Traditional Privileged Access Management
The traditional approach to privileged access management has been to automatically change the passwords for privileged accounts several times per day, and store the passwords in a password vault. A jump server or client software is then used to authenticate the user, obtain the current password from the vault, and log in to the target server.
Alternatively, a web portal may be provided for obtaining the current password for the target account and displaying it to the user. The password would typically be valid for a fixed period, such as one hour, or until expressly released by the user.
The traditional analyst worldview on PAM has been on the traditional approach. They compare products based on their password rotation, password vaulting, etc features. But the next generation needs none of this. It solves privileged access management differently.
Problems of Traditional Privileged Access Management in the Cloud
PAM deployments are notoriously difficult. Read, for example, http://security-architect.com/privileged-account-management-pam-is-very-important-but-deploying-it-stinks/.
The traditional approach changes the way system administrators work and many administrators hate it. It also requires substantial infrastructure, with some large organizations reportedly needing over a hundred vaults/jump servers to scale to their infrastructure. Password vaults become a single point of failure. For automation, every script has to be changed to obtain the password from a vault.
The traditional approach also does not scale into cloud, containers, and particularly elastically scaling computing environments. It becomes very cumbersome to implement password vaulting when computing instances go up and down as needed and often only live for a few seconds.
Furthermore, the traditional approach often requires installing (and patching!) software on servers and clients. This is costly and resource-intensive.
Read more about PAM in the cloud >
What to look for in new Privileged Access Management
New technology has made it possible to implement privileged access management without password vaulting and without new software or agents installed on servers or clients. This substantially speeds up deployment, reduces overhead, and helps scale to cloud and elastic environments.
A truly modern and future-proof Privileged Access Management for multi-cloud needs and agile architecture. It is designed for elastic cloud environments from the start. It gets rid of passwords, password vaulting, and password rotation. Deployment becomes way easier and faster. The total project cost is greatly reduced, and the time to full deployment easily drops by a factor of ten.
PAM without password vaults and password rotation...
Next-gen PAM uses short-lived ephemeral certificates, invisible to the end-user, to enable access over secure SSH and RDP connections. Your privileged users get a one-click jump host to the right cloud hosts via SSO and with optional MFA.
This approach is passwordless and keyless since just-in-time access is used for authentication, but the authorization to the target expires automatically, leaving no keys or passwords behind to manage, forget, or lose.
...except when you need them for privileged access
The reality is that going passwordless and keyless is not possible overnight. Customers have legacy environments that require key management, password vaulting, and rotation.
For this reason, the next-gen PAM needs to be hybrid and supports various credential management methods. It allows customers to manage access to their legacy critical infrastructures while migrating to more modern access approaches at the same time as they modernize their applications.
Privileged 3rd & party access centralized
Agile business units need to grant all types of secure access to critical resources: permanent, temporary, internal, and external. With PrivX, all your sessions are granted, secured, and controlled through one, centralized system. Say goodbye to backdoors and rogue keys.
PAM for Multi-cloud, hybrid cloud, and on-prem
Next-gen PAM software makes managing privileged user access scalable, lean, and rapid to deploy to multi-cloud and hybrid. Administrators enjoy role-based access control (RBAC) and re-use of existing AD/LDAP groups to automate access provisioning.
Users make 1-click SSH or RDP connections from their browser – without sharing credentials, using SSH keys or password vaults. No need to install anything on the client or the server.
Autodiscover global cloud instances with PAM
Next-gen PAM solution comes with an auto-discovery feature that automatically scans your environment for all the available cloud hosts at all times from all regions. Your admins get a single pane of glass to cloud hosts. Your developers always know which host they can access.
Save valuable time on deploying privileged access management
Installation, deployment, and configuration of future-proof PAM only takes a day. After that, maintenance work is lightweight and straightforward. Don’t worry about dedicating a team to handle a high-cost, high-maintenance product: the PAM solution leaves no footprint in your environment and updates automatically.
Integrate PAM with AD, LDAP & IdaaS
Next-gen PAM helps you avoid duplicate work. You use your existing user identities from your AD/LDAP and the solution fetches user groups for you automatically. It’s not like basic PAMs where you have to duplicate your users manually or worry about keeping two separate systems up-to-date!
FAQ
What distinguishes privileged access from standard user access, and how can organizations take their account security to the next level?
Privileged access provides elevated permissions to modify critical systems, unlike standard user accounts with limited access. Organizations can enhance security by implementing strong authentication, regularly auditing privileged activities, and following the principle of least privilege to minimize risks.
Can you provide examples of PAM solutions that are effective in both on-premises and cloud environments?
Examples of PAM solutions include centralized credential management, multi-factor authentication, session recording, and automated auditing, all of which can secure privileged access for both on-premises and cloud environments.
How does PAM help organizations improve their identity and access management strategy?
PAM enhances identity and access management by ensuring only authorized users gain access to critical systems, enforcing the principle of least privilege, and providing detailed auditing for compliance and security purposes.
What capabilities should you look for in a PAM software solution?
Key capabilities to look for in a PAM software solution include robust authorization methods, secure password vaulting, automated password rotation, session monitoring and recording, alerting and threat detection, and comprehensive reporting for audit and compliance purposes. These capabilities help ensure that privileged access is both secure and manageable.
