Privileged Access Management (PAM) Demystified

Privileged Access Management (PAM) is an information security (infosec) mechanism that safeguards identities with special access or capabilities beyond regular users. Like all other infosec solutions, PAM security works through a combination of people, processes and technology.

We treat privileged accounts with extra care because of the risk they pose to the technology environment. For example, should the credentials of an administrator or service account fall into the wrong hands, it could lead to the compromise of the organization's systems and confidential data.

Data breaches occur when threat actors compromise privileged access accounts. As these accounts hold the keys that unlock every door in a technology environment, we need to add additional layers of protection. That extra security is a Privileged Access Management solution.

In a technology environment, privileged access refers to accounts with elevated capabilities beyond regular users. For example, in a Linux environment, the root user can add, amend or delete users; install and uninstall software and access restricted parts of operating systems that are off-limits to a standard user. Windows environments follow a similar security construct, but the root user in that instance is called an administrator.

Let's illustrate the concept of privileged access with a real-world banking example. A typical bank has customers, tellers and managers. Each 'user' has different levels of authority when it comes to accessing the bank's cash. Customers can only access the money in their bank accounts. Tellers have more privileges than regular customers as they have access to all the cash in their respective drawers. Managers have even greater access than tellers, as they can access the money stored in the bank's vault. Technology systems also use this tiered privilege access model. Your role within the system determines what you can or cannot do.

In our banking example, the tellers and managers would be the users with privileged access. As these roles have access to more of the bank's cash than customers, the bank needs to implement additional security measures before granting tellers and managers access. For instance, during their job interviews, they may need to pass a criminal record check. When they start working at the bank, their role will also determine their physical access. For example, tellers may be able to enter the secure area of the bank, but only managers will have the privileged access needed to enter the vault.

Privileged Access Management is a security mechanism that consists of various components. Depending on the security problem the solution is trying to solve, different processes and technologies come into play.

As the name suggests, Privileged Account Management refers to the mechanisms that manage and audit accounts that have system access beyond that of a standard user. In some Privileged Access Management systems, Privileged Account Management refers to the technology that stores credentials. For instance, an administrator may manage a portal that defines and controls methods to access the privileged account across various applications and enterprise resources. The Privileged Account Management portal stores the credentials of privileged accounts (such as their passwords) in a special-purpose and highly secure password vault. In addition to storing the credentials, the portal can also enforce policies regarding their conditions of access. For example, it may hold the credentials of a privileged service account that runs a critical system. Users that require access to those credentials may need to use a unique authentication mechanism. In some instances, these portals automatically change the password in the vault and on the system, ensuring the credentials remain secure after someone has accessed them.

We often refer to these privileged accounts as superusers or administrators. However, privileged accounts can also refer to non-human users accounts. For instance, some enterprise services require a system account to access confidential data or restricted networks. You may also have services that rely on shared secrets such as encryption keys that grant regular users access. As all these privileged accounts have access to confidential data and secure environments, we need to implement additional IT-security measures to protect them.

Privileged Session Management is a component of a Privileged Access Management solution that enables administrators to monitor, manage and audit the activities of privileged users. It tracks and logs sessions initiated by internal and external users and connected systems with abilities beyond that of a standard user. These solutions reduce risk by notifying security administrators of any anomalous session activity that involves a privileged account.

As mentioned, Privileged Access Management is a combination of people, processes and technology. Therefore, the first step in implementing a PAM solution is identifying which accounts have privileged access. Following that, the business needs to decide which policies they will apply to these accounts.

For instance, they may state that service accounts must renew their password each time a user accesses its stored credentials. Another example would be enforcing Multi-Factor Authentication (MFA) for all system administrators. Keeping a detailed log of all privileged sessions is another policy the organization may decide to implement. Ideally, each process should align with a particular risk. For example, forcing a change for service account passwords mitigates the risk of an insider threat. Likewise, keeping a log of all privileged sessions allows security administrators to identify any anomalies, and enforcing MFA is a proven solution to mitigate password-related attacks.

Once the organization completes its discovery phase of identifying privileged accounts and finalizes its PAM policies, it can implement a technology platform to monitor and enforce its Privileged Access Management. This PAM solution automates the organization's policies and provides security administrators with a platform to manage and monitor privileged accounts.

A Privileged Access Management solution must have the capabilities to support the PAM policies of an organization. Typically, an enterprise PAM will have automated password management features that include a vault, auto-rotation, auto-generation and an approval workflow. In addition to these password management capabilities, it should also provide administrators with the ability to implement and enforce multi-factor authentication.

An enterprise-grade Privileged Access Management Solution should also offer organizations the capability to manage privileged account lifecycles. In other words, it must give administrators the ability to automate the creation, amendment and deletion of accounts. Finally, a PAM solution must provide robust monitoring and reporting. As security administrators need to monitor privileged sessions and investigate any anomalies, it needs to provide real-time visibility and automated alerting.

Privileged Access Management (PAM) is a component of a broader Identity and Access Management (IAM) solution. PAM deals with the process and technologies needed to secure privileged accounts. On the other hand, an IAM solution offers password management, Multi-Factor Authentication, Single Sign-On (SSO) and user lifecycle management for all accounts, not just those with privileged access.

The Principle of Least Privilege (POLP) is a security model that states users, networks, devices and workloads should have the minimum access they need to perform their function and nothing more. On the other hand, Privileged Access Management deals with security processes and technologies required to protect privileged accounts. Therefore, while PAM enables some of the factors needed to enforce the Principle of Least Privilege, it is not the only technology to do so.

PAM provides administrators with the functionality, automation and reporting they need to manage privileged accounts. In addition, it supports the principle of least privilege as it allows for the necessary management and oversight to mitigate the risk of accounts that have capabilities beyond the standard user. However, organizations have access to other information security mechanisms to enforce the principle of least privilege. For example, they could implement Role-Based Access Control (RBAC) on every system. Other examples of enforcing the principle of least privilege include segmenting and securing their networks with VLANs and ensuring users are not local administrators on their corporate workstations.

Privileged Access Management is vital in any organization as privileged accounts pose a significant risk to the enterprise. For instance, if a threat actor compromises a standard user account, they will only have access to that particular user's information. However, if they manage to compromise a privileged user, they will have far greater access and, depending on the account, may even have the ability to sabotage systems.

Due to their status and profile, cybercriminals target privileged accounts so that they can compromise entire organizations instead of a single user. With Forrester estimating that 80 percent of security breaches involve privileged accounts, securing and monitoring these core enterprise identities is vital. For instance, a PAM solution can solve security weaknesses, such as multiple users accessing and knowing the same administrative password for a particular service. It also mitigates the risk of long-standing static passwords administrators do not want to change because they fear it could cause an unplanned disruption.

PAM controls key aspects of secure access and simplifies the provisioning of administrator user accounts, elevated access rights and configuration for cloud applications. In terms of IT security, PAM reduces an organization’s attack surface across networks, servers and identities. It also decreases the probability of data breaches by internal and external cybersecurity threats.

A Privileged Access Management solution is only as effective as its implementation. Therefore, organizations should consider the following best practices:

• Implement the Principle of Least Privilege - You cannot manage privileged accounts without first implementing the Principle of Least Privilege. Locking down an environment so that only privileged accounts can access particular resources is a prerequisite for a successful PAM solution.

• Keep track of all privileged accounts - You cannot manage a privileged account if it is not part of your PAM solution.

• Consider temporary privilege escalation - Instead of granting a user perpetual privileged access, consider only providing access when needed and then removing it.

• Use Role-Based Access Control - Privileged Access Management only works on a system if you have differing role-based access levels. For example, if everyone is an administrator, it is much more challenging to secure and manage.

• Automate - Automation reduces the risk of human error and increases the efficiency of your information security environment.

• Monitor, Log, and Audit - Continuous monitoring and actively logging all privileged account activity is vital in ensuring an organization has the insights it needs to protect its environment. However, it is also crucial that an audit on the logs occurs regularly. Without it, the organization would not have the information it needs to identify potential risks and implement measures to mitigate them.