CISO's guide to privileged access management

PAM features and capabilities

PAM acts as a central access point, handling privileged account discovery and asset inventory and identifying, classifying and monitoring these accounts across directories, databases, servers, network devices and cloud environments.

These platforms securely store credentials, including administrator passwords and keys, in an encrypted vault. PAM restricts who can access them and dictates retrieval rules. PAM oversees password lifecycle management, automatically updating passwords and keys and administering privileged credential onboarding and offboarding. These platforms also manage time-bound data retrieval on an as-needed basis, enforcing stringent standing privileges.

Organizations use PAM to support least-privilege enforcement and, when necessary, privilege elevation, ensuring granular permission enforcement. PAM brokers, records and facilitates forensic examinations of RDP, SSH, SQL and other privileged sessions without revealing credentials to the user. Security practitioners can use PAM for workflow approvals and to grant access requests.

PAM systems also consolidate access logs to streamline compliance support for a variety of regulations, including PCI DSS and HIPAA. PAM systems work with IAM, single sign-on, MFA and directory services to ensure privileged access maps to corporate identity governance mandates. Security professionals can tap into privileged analytics and threat detection to discern harmless anomalies from activity that represents real threats, such as unusual travel, excessive use of privileges and risky commands.

Benefits and challenges of PAM

Security practitioners rely on PAM to strengthen defenses on multiple fronts. PAM helps shrink the enterprise's attack surface by restricting access to high-value, sensitive content and upholding the tenets of least privilege -- ensuring users have only the level of access they need for the shortest time. This helps block adversaries who breach a system from using administrative credentials to move laterally across the network to other resources.

PAM platforms give security teams a clear perspective on privileged access, tracking all activity in real time and building audit trails and session logs for compliance purposes. From an efficiency perspective, PAM can automate standard credential management, including rotation and access requests.

But as with most security controls, PAM has its challenge. It can introduce friction into the environment by requiring actions that some users might perceive as overly restrictive or even as impeding productivity. PAM platforms can also be costly to deploy, introducing licensing expenses, setup costs and new hardware. Security practitioners are sometimes critical of PAM for being difficult to integrate with legacy hardware or applications.

There's also a fair amount of maintenance required to keep up with shifting requirements. Security practitioners must stay on top of rule updates and audit logs. PAM can interfere with standard workflows, requiring approvals that can delay access. There's also always a risk that users will adopt shadow IT mechanisms to circumvent controls to speed access.

PAM can also introduce a central vulnerability: if adversaries crack the vault, they can obtain all critical credentials within the organization. At the same time, if security professionals make a configuration error, they might block a legitimate security manager from administrative access.

PAM best practices for long-term success

To derive the maximum benefit from PAM, security teams must implement pragmatic, effective best practices, including the following:

• Account and asset discovery. Scan the environment for every account, including hidden service and root accounts. Categorize all risk levels by the negative effects the organization would experience in the event of theft or compromise, so teams can prioritize protecting these assets.
• Set and review permissions. Conduct a foundational review of access rights and eliminate permanent permissions. Implement just-in-time access that provides time-bound access to assets only for the period the user needs them. Don't use fixed credentials; instead, automate password and key revisions after each use. Integrate PAM with employee directories to enable more efficient onboarding and offboarding.
• Measure success. Monitor metrics, such as capturing a drop in help desk password reset requests and reducing time in compliance audits. Also, check audit logs to demonstrate that high-risk behavior has declined.

How PAM fits into an IAM strategy

Although important to the bigger security picture, PAM is just one element in the whole identity management story. IAM offers the baseline, delivering authentication and role-based access to corporate assets. PAM adds granular visibility and enforcement controls for privileged access through administrative gateways. This ensures that users have permission only to the assets they need to carry out a specific task, and that access expires after the task is completed.

Amy Larsen DeCarlo has covered the IT industry for more than 30 years, as a journalist, editor and analyst. As a principal analyst at GlobalData, she covers managed security and cloud services.